The aBlocks – WordPress Gutenberg Blocks plugin suffers from missing capability checks on multiple AJAX actions in all versions up to 2.4.0. This lack of authorization validation permits authenticated users with low privileges (subscriber level and above) to access and read sensitive plugin settings such as block visibility, maintenance mode configurations, and third-party email marketing API keys. The vulnerability is tracked as CWE-862 (Missing Authorization) and has a CVSS v3.1 base score of 5.4, indicating a medium severity impact with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with subscriber-level access can read sensitive configuration data including API keys for email marketing services and plugin settings that should be restricted. This unauthorized disclosure could lead to further compromise of integrated services or leakage of sensitive operational information. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing sensitive API keys in plugin configurations accessible to low-privilege users.