Technical impact
The aBlocks plugin for WordPress allows a user with Contributor or higher privileges to change another user’s role by submitting a specially crafted request to the REST endpoint /ablocks/v1/form-builder/registration. The endpoint accepts data without permission checks and does not confirm that the form block type is registration before reading the roleSlug value. By saving a form block as a login type, an attacker can embed a roleSlug for a higher role and then invoke the endpoint while authenticated, leading to the upgrade of their own WordPress role via WP_User::set_role() and wp_set_auth_cookie(). The vulnerability is limited to non‑administrator roles, with Editor being the highest reachable role on a standard installation.
Affected Systems
WordPress installations running the aBlocks Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin from Kode Zen, any version 2.17.0 or earlier. The vulnerability exists across all affected releases, regardless of the specific version number within that range.
Risk and Exploitability
The CVSS score of 8.8 classifies this flaw as high severity, and while the EPSS score is unavailable, the lack of security controls on the exposed REST endpoint and the easy construction of role‑changing payloads means that authenticating attackers can exploit it once the plugin is installed. The flaw is not listed in the CISA KEV catalog, however the description of the plugin’s popularity and the vulnerable endpoint suggests that attackers could develop automated exploitation tools. The attack path requires only a Contributor‑level login and a valid WP REST nonce, both of which a legitimate site contributor typically possesses. Consequently, the likelihood of exploitation is significant in environments where contributors are retained long enough to search for such weaknesses or in compromised sites where attacker accounts exist.
