The bBlocks WordPress plugin is vulnerable due to missing authorization checks and inadequate input handling in the rgfr_registration() function. This flaw allows an unauthenticated user to call the registration endpoint and create a new account that is granted administrator privileges. The attacker thereby obtains full administrative control over the WordPress site, enabling modification of content, installation of additional plugins, and data exfiltration. The weakness aligns with CWE‑862, representing an authorization flaw.

All installations of the bBlocks plugin for WordPress up to and including version 2.0.6 are affected. The vulnerability applies to every user of bBlocks, regardless of role, as the registration endpoint does not enforce any authentication or role checks.

The flaw receives a CVSS score of 9.8, placing it in the "Critical" severity range. The EPSS score is reported as less than 1%, indicating a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but the combination of high severity, straightforward exploitation path, and the ability to generate privileged accounts makes this a high‑risk issue. An attacker only needs to construct a request to the rgfr_registration endpoint, with no prior privileges, to achieve escalation.