Vulnerability feed

Executive summary

The aBlocks WordPress plugin, which adds block and form builder features, has a privilege escalation flaw in all versions up to and including 2.17.0. An authenticated user with Contributor-level access or higher could use it to raise their own role, up to Editor on a standard installation. The advisory does not state a CVSS score or a fixed version.

Technical summary

The flaw is a privilege escalation issue caused by a REST endpoint at /ablocks/v1/form-builder/registration that is registered with a permission callback of __return_true and reads roleSlug from block attributes stored in post_content without checking that formType is registration. A Contributor can save a block with formType set to login to preserve an arbitrary roleSlug, then trigger the endpoint using a valid wp_rest nonce and post ownership check, and receive an authenticated session at the elevated role via WP_User::set_role() and wp_set_auth_cookie(). The advisory states that is_safe_registration_role() blocks roles holding manage_options, edit_users, delete_users, create_users, promote_users, or edit_theme_options, so the highest reachable role is said to be Editor. The fixed version, vendor workaround, and detection guidance are not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

Kodezen LLCaBlocksKodezen LLC aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation BuilderaBlocks