{"api_version":"1","generated_at":"2026-10-24T14:05:30+00:00","cve":"CVE-2026-110018","urls":{"html":"https://cve.report/CVE-2026-110018","api":"https://cve.report/api/cve/CVE-2026-110018.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-110018","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-110018"},"summary":{"title":"aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute","description":"The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe_registration_role()` rejects any role holding `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, meaning the highest practically reachable role on a standard WordPress installation is Editor.","state":"PUBLISHED","assigner":"Wordfence","published_at":"2026-10-24 12:16:54","updated_at":"2026-10-24 12:16:54"},"problem_types":["CWE-269","CWE-269 CWE-269 Improper Privilege Management"],"metrics":[{"version":"3.1","source":"security@wordfence.com","type":"Primary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L70","name":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L70","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L345","name":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L345","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L353","name":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L353","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/blocks/form-builder/block-attr-sanitizer/sanitizers/form-builder/registration-form-sanitizer.php#L28","name":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/blocks/form-builder/block-attr-sanitizer/sanitizers/form-builder/registration-form-sanitizer.php#L28","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fe7efb5-540b-4d85-852f-ad572da7ecdd?source=cve","name":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fe7efb5-540b-4d85-852f-ad572da7ecdd?source=cve","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3756864%40ablocks&new=3756864%40ablocks","name":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3756864%40ablocks&new=3756864%40ablocks","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L685","name":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L685","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110018","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110018","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"kodezen","product":"aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","version":"affected 2.17.0 semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-10-21T15:41:41.000Z","lang":"en","value":"Vendor Notified"},{"source":"CNA","time":"2026-10-23T21:31:29.000Z","lang":"en","value":"Disclosed"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Wordfence PRISM","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","vendor":"kodezen","versions":[{"lessThanOrEqual":"2.17.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Wordfence PRISM"}],"descriptions":[{"lang":"en","value":"The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe_registration_role()` rejects any role holding `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, meaning the highest practically reachable role on a standard WordPress installation is Editor."}],"metrics":[{"cvssV3_1":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-24T11:30:30.545Z","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence"},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fe7efb5-540b-4d85-852f-ad572da7ecdd?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L353"},{"url":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L70"},{"url":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L345"},{"url":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/blocks/form-builder/block-attr-sanitizer/sanitizers/form-builder/registration-form-sanitizer.php#L28"},{"url":"https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L685"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3756864%40ablocks&new=3756864%40ablocks"}],"timeline":[{"lang":"en","time":"2026-10-21T15:41:41.000Z","value":"Vendor Notified"},{"lang":"en","time":"2026-10-23T21:31:29.000Z","value":"Disclosed"}],"title":"aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute"}},"cveMetadata":{"assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","assignerShortName":"Wordfence","cveId":"CVE-2026-110018","datePublished":"2026-10-24T11:30:30.545Z","dateReserved":"2026-10-13T14:56:35.053Z","dateUpdated":"2026-10-24T11:30:30.545Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-24 12:16:54","lastModifiedDate":"2026-10-24 12:16:54","problem_types":["CWE-269","CWE-269 CWE-269 Improper Privilege Management"],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"110018","Ordinal":"1","Title":"aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escal","CVE":"CVE-2026-110018","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"110018","Ordinal":"1","NoteData":"The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe_registration_role()` rejects any role holding `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, meaning the highest practically reachable role on a standard WordPress installation is Editor.","Type":"Description","Title":"aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escal"}]}}}