WordPress security changelog
HIGH CVE-2026-110018 Received

aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: Contributor-to-Editor privilege escalation

aBlocks through 2.17.0 lets a Contributor or higher save a block in their own post with formType set to login and an attacker-chosen roleSlug, bypassing the registration-only save-time check in RegistrationFormSanitizer::verify(). The /ablocks/v1/form-builder/registration REST route has a permissive permission callback; register() reads roleSlug from post_content without checking at runtime that formType is registration. A valid wp_rest nonce and post ownership are still required. WP_User::set_role() and wp_set_auth_cookie() then grant the elevated role and an authenticated session. is_safe_registration_role() rejects roles with administrator-tier capabilities, so the disclosed escalation reaches Editor or another permitted non-Administrator role, not Administrator on standard WordPress.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
Plugin slug
ablocks
Affected
<= 2.17.0
Safe version
See mitigation notes
Published
Oct 24, 2026
Weakness
CWE-269 — Improper Privilege Management

This CVE was published Oct 24, 2026 and is one of 6 known issues for this plugin.

What to do

Update, patch or deactivate.

Official author notes reviewed on 2026-10-24 list 2.18.0, but their general dynamic-content security note does not confirm a fix for this registration-role bypass. Version 2.18.0 may resolve the issue, but a fixed version for this CVE is not confirmed. The earlier 2.17.0 role-restriction note is not treated as a fix because the CNA explicitly includes 2.17.0 as affected. This is an evidence limitation, not a finding that 2.18.0 remains vulnerable. Restrict untrusted Contributor access to the affected forms until remediation is established. At runtime, require a registration form and authorize the requested role against trusted server-side policy before changing roles or issuing a session; nonce and ownership checks alone are insufficient. Review unexpected role changes. Official release notes: https://wordpress.org/plugins/ablocks/#developers.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe_registration_role()` rejects any role holding `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, meaning the highest practically reachable role on a standard WordPress installation is Editor.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources