Technical impact
The CVE exposes an incorrect privilege assignment flaw in the aBlocks plugin developed by Kodezen LLC, enabling privilege escalation. Attackers with lower privileges can gain higher permissions within a WordPress site by exploiting the plugin’s permission handling. This vulnerability affects all aBlocks releases prior to version 2.9.1, although no specific WordPress core versions are impacted. The flaw is classified as CWE‑266, highlighting issues around improper privilege allocation.
Affected Systems
The aBlocks plugin from Kodezen LLC, versions from the earliest release up to, but excluding, 2.9.1, is affected on any WordPress installation that includes the plugin. No specific WordPress core versions are listed as impacted.
Risk and Exploitability
The CVSS score of 8.8 indicates a high severity issue, while the EPSS score of less than 1% suggests a low probability of automated exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, exploitation would likely require an attacker to have or acquire some authenticated access to the WordPress admin area, or to trigger the plugin’s functionality through the web interface, enabling them to leverage the privilege escalation flaw.
