A newly disclosed flaw tracked as CVE-2026-107645 affects the Blocksy Companion plugin for WordPress up through version 2.1.58. The bug comes from a registration handler that turns off a vendor nonce check and then blindly trusts whatever account role an attacker includes in their request. That gap lets an unauthenticated visitor create a brand-new account and hand themselves elevated privileges in the process.
// source: nvd.nist.gov ↗