CVE-2026-110018
Received Received - Intake

Privilege Escalation in aBlocks WordPress Plugin

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: Wordfence

Description
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe_registration_role()` rejects any role holding `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, meaning the highest practically reachable role on a standard WordPress installation is Editor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-110018
EUVD
EUVD-2026-109265

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation flaw in the aBlocks WordPress plugin up to version 2.17.0. It allows authenticated attackers with Contributor-level access or higher to escalate their role to Editor or another non-administrator role by exploiting a REST endpoint that improperly validates user-controlled input. The endpoint registers with unrestricted permissions and reads roleSlug directly from attacker-controlled block attributes without proper verification.

Detection Guidance

Check for unauthorized role changes in WordPress user logs. Inspect REST API requests to the /ablocks/v1/form-builder/registration endpoint. Look for Contributor-level users with elevated roles like Editor. Use WordPress security plugins to monitor privilege escalation attempts.

Impact Analysis

If you use the aBlocks plugin on your WordPress site, an attacker with Contributor access could escalate their privileges to Editor or another role. This could allow them to perform unauthorized actions like editing posts, managing user roles, or accessing sensitive content. The impact depends on your site's configuration and the roles assigned to users.

Compliance Impact

This vulnerability could lead to unauthorized access and privilege escalation, which may violate compliance requirements for GDPR, HIPAA, or other regulations. Unauthorized role escalation could result in data breaches, improper access to sensitive information, or failure to maintain data integrity and confidentiality.

Mitigation Strategies

Update the aBlocks plugin to the latest version if available. Temporarily disable the plugin if no update exists. Restrict Contributor-level access to untrusted users. Monitor user roles and privileges for suspicious changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110018. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart