WordPress Plugin Vulnerabilities

aBlocks < 2.9.1 - Contributor+ Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation, making it possible for authenticated attackers with Contributor-level access and above to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
ablocks
Fixed in 2.9.1

References

CVE
CVE-2026-57386
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5a495893-d148-42b7-b029-bc7234e60bc6

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (High)

Miscellaneous

Original Researcher
Evan NR
Verified
No
WPVDB ID
4b522dd3-127b-4f85-8089-7d90bcddfced

Timeline

Publicly Published
2026-07-07 (about 19 days ago)
Added
2026-07-16 (about 9 days ago)
Last Updated
2026-07-16 (about 9 days ago)

Other

Published
Title
Published
2024-09-30
Title
Echo RSS Feed Post Generator < 5.4.7 - Unauthenticated Privilege Escalation
Published
2024-07-10
Title
InstaWP Connect – 1-click WP Staging & Migration < 0.1.0.45 - Authentication Bypass to Admin
Published
2019-12-24
Title
Featured Image from URL <= 2.7.7 - Missing Access Controls on REST routes
Published
2024-10-09
Title
UserPlus <= 2.0 - Editor+ Registration Form Update to Privilege Escalation
Published
2026-07-10
Title
WP Grid Builder < 2.3.4 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter