Privilege Escalation in aBlocks Plugin for WordPress
CVE-2026-110018
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 24 October 2026
What is CVE-2026-110018?
The aBlocks plugin for WordPress contains a vulnerability that allows authenticated attackers with Contributor-level access to escalate their privileges. This occurs through the /ablocks/v1/form-builder/registration REST endpoint, which is incorrectly configured to accept roles without proper verification. As a result, attackers can craft a request that instigates the WP_User::set_role() function, enabling them to elevate their role to Editor or other non-administrator levels. The vulnerability is deeply concerning as it can lead to unauthorized access and abuse of website functionalities. The flaw exists in all versions up to 2.17.0 and arises from a failure to validate user roles during the registration process.
Affected Version(s)
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder 0 <= 2.17.0