IT SBIT Services
Schneeberger
DEEN
CVE tracker

aBlocks WordPress plugin: Privilege escalation via roleSlug block attribute

CVE-2026-110018High 8.8

← All vulnerabilities

Summary

The aBlocks WordPress plugin up to and including version 2.17.0 contains a privilege escalation flaw in the /ablocks/v1/form-builder/registration REST endpoint. The endpoint reads the roleSlug value from block attributes stored in post content without verifying that the form type is registration. An authenticated user with Contributor rights or higher can use this to raise their WordPress role to Editor or another non-administrator role and obtain a new authenticated session at that level. Roles with administrative capabilities are excluded by a check in the plugin.

Affected

  • aBlocks (kodezen) versions 0 up to and including 2.17.0
  • WordPress installations with the aBlocks plugin active

Fixed in

  • Update to a version later than 2.17.0. Third-party sources name 2.17.1, but this is not confirmed by the vendor's changelog or advisory.

Workaround

  • No vendor-confirmed workaround known.
  • Review which users hold Contributor or higher roles and remove unneeded accounts.
  • Check for recent role changes to Editor or higher.

Exploitation

  • Exploited in the wild: Unknown. No known exploitation reported in the sources.
  • Public proof of concept: none found.
  • CISA SSVC: Exploitation none, automatable no, technical impact total.

Our recommendation

  • Update the aBlocks plugin to the latest version as soon as a fixed version is confirmed by the vendor; treat 2.17.0 as affected.
  • Review all accounts with Contributor or higher rights and check for unexpected role changes to Editor or above.
  • Remove unneeded accounts and restrict self-registration and guest contributor access.
  • Monitor for public proof-of-concept code and for vendor advisories.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:37.

Original description (NVD)

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe_registration_role()` rejects any role holding `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, meaning the highest practically reachable role on a standard WordPress installation is Editor.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed