The aBlocks WordPress plugin suffers from absent capability checks on several AJAX actions. Authenticated users with a Subscriber role or higher can modify block visibility, maintenance mode, and other settings, and can read third‑party email marketing API keys. This lack of authorization enables the attacker to alter site behaviour and expose confidential configuration information, reflecting CWE‑862.

All installations of kodezen’s aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress up to and including version 2.4.0 are affected. The vulnerability exists across all WordPress sites that have not applied the latest plugin release.

The CVSS score of 5.4 classifies this as a medium impact vulnerability. The EPSS score of less than 1% suggests a low probability of current exploitation, and the vulnerability is not catalogued in CISA’s KEV list. Because only authenticated access is required, the attack vector is internal; a user who can log in with Subscriber or higher privileges can trigger the vulnerable AJAX calls to read or change settings. No additional network or privilege escalation is required beyond normal authenticated access.