WordPress Plugin Vulnerabilities

bBlocks < 2.0.32 - Contributor+ Privilege Escalation

Description

The plugin is vulnerable to privilege escalation. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
b-blocks
Fixed in 2.0.32

References

CVE
CVE-2026-39579
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/89218de3-7bb9-42f5-86d8-48d28c380231

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Abu Hurayra (HurayraIIT)
Verified
No
WPVDB ID
1573fea4-f3bd-4039-88bc-6c3c437f0af4

Timeline

Publicly Published
2026-04-16 (about 4 months ago)
Added
2026-04-21 (about 4 months ago)
Last Updated
2026-04-21 (about 4 months ago)

Other

Published
Title
Published
2025-04-02
Title
wpForo Forum < 2.4.4 - Subscriber+ Privilege Escalation
Published
2025-05-06
Title
Woocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation
Published
2024-10-16
Title
Miniorange OTP Verification with Firebase < 3.6.1 - Privilege Escalation via Registration due to Administrator Default User Role Value
Published
2026-05-20
Title
Divi Form Builder < 5.1.3 - Unauthenticated Privilege Escalation via 'role'
Published
2025-07-22
Title
Social Streams <= 1.2.1 - Subscriber+ Privilege Escalation