CVE-2026-110018VulnerabilityPublished 10/24/2026

CVE-2026-110018: CWE-269 Improper Privilege Management in kodezen aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder

Affects kodezen aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation BuilderSource CVE Database V5

CVSS 3.1 base score

8.8High

Exploitation: Not in CISA KEV, no exploitation reported

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What to do

AI-suggested

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level user access and monitor for suspicious activity involving the `/ablocks/v1/form-builder/registration` REST endpoint. Consider disabling or restricting the plugin if possible to prevent exploitation.

Affected software

Product	Affected	Fixed in
kodezenaBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder	Affected >=0 <=2.17.0	Fixed in–

Description

The aBlocks WordPress plugin up to version 2.17.0 contains a privilege escalation vulnerability via a REST endpoint that allows authenticated users with Contributor-level access or higher to elevate their role to Editor or other non-administrator roles. This occurs because the endpoint does not properly verify permissions and reads role information from attacker-controlled content. The vulnerability is bounded to roles below administrator level.

Summary

CVE-2026-110018 describes a privilege escalation vulnerability in the aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder WordPress plugin versions up to and including 2.17.0. The vulnerability arises from the `/ablocks/v1/form-builder/registration` REST endpoint being registered with a permission callback that always returns true, allowing authenticated users with Contributor-level access or above to invoke it. The endpoint reads the `roleSlug` parameter from attacker-controlled block attributes without verifying that the block's `formType` is 'registration'. This verification is only enforced at save-time, enabling an attacker to save a block with a different `formType` but an arbitrary `roleSlug`. By triggering the endpoint with a valid REST nonce and post ownership, the attacker can escalate their WordPress role to Editor or any other non-administrator role. The escalation is limited because roles with high privileges such as administrator are rejected by the `is_safe_registration_role()` check. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity.

Impact

Authenticated users with Contributor-level access or higher can escalate their privileges to Editor or other non-administrator roles, gaining elevated capabilities and a fully authenticated session at the higher privilege level. This can lead to unauthorized content modification and management actions within WordPress. The vulnerability does not allow escalation to administrator-level roles, limiting the scope of impact but still posing a significant risk to site integrity and security.

Weaknesses

CWE-269Improper Privilege Management (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 10/24/2026, 11:41:59 UTC

Technical details

Weaknesses

References

Related threats