WordPress aBlocks Plugin Unauthenticated Privilege Escalation

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator ro

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The aBlocks plugin for WordPress contains a critical privilege escalation vulnerability in its REST API endpoint `/ablocks/v1/form-builder/registration`. The flaw stems from improper access controls—the endpoint permits unauthenticated requests via `permission_callback => __return_true`—combined with insufficient input validation on the `roleSlug` parameter. An attacker can exploit this to arbitrarily assign user roles, effectively escalating their privileges from unauthenticated visitor to administrator. This affects all WordPress sites running aBlocks versions up to 2.17.0, making it a high-impact threat given WordPress's widespread adoption. The vulnerability enables complete site takeover and is particularly dangerous because exploitation requires no authentication and leaves minimal traces if not actively monitored.

Casky's 224 matched skills leverage Claude's extended reasoning to map this vulnerability across MITRE ATT&CK's Privilege Escalation technique (TA0004). Practitioners using Casky would see detection patterns focused on: unauthenticated REST API calls to `/ablocks/v1/form-builder/registration`, suspicious POST requests containing `roleSlug` parameters with administrative values, and sudden privilege escalations linked to REST endpoint activity. Claude's reasoning engine helps correlate these indicators—connecting failed authentication bypass attempts, role assignment anomalies, and post_content manipulation—to surface the attack chain. Security teams would identify findings showing privilege escalation from anonymous user to contributor/editor/administrator roles within minutes of exploitation attempts, enabling rapid response before attackers establish persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-110018.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-110018

Casky has 224 skills that investigate the attack patterns behind CVE-2026-110018. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn