Executive Summary
CVE-2026-110018 is a privilege escalation vulnerability (CVSS 8.8) in the aBlocks WordPress plugin (Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder and Animation Builder). All versions up to and including 2.17.0 are affected. NVD published the entry on October 24, 2026.
The flaw sits in the /ablocks/v1/form-builder/registration REST endpoint. A user registering through it can gain more privileges than intended, which on WordPress typically means reaching an administrator role.
Vulnerability Overview
| Field | Detail |
|---|---|
| CVE | CVE-2026-110018 |
| CVSS | 8.8 (High) |
| Component | /ablocks/v1/form-builder/registration REST route |
| Affected | aBlocks 2.17.0 and earlier |
| Published | October 24, 2026 |
The NVD description is truncated in the source feed. The root cause should be confirmed against the full NVD entry or the plugin's changelog.
Impact
- Site takeover: an elevated account can install plugins, edit theme files, and execute PHP.
- Data access: user records and form submissions become readable.
- Persistence: attackers commonly add hidden admin users or web shells after escalating.
Remediation
- Update aBlocks to the latest release once a fixed version above 2.17.0 is available. If none exists yet, deactivate and remove the plugin.
- Audit Users in the WordPress dashboard for unexpected administrator or editor accounts.
- Block or rate-limit the
/wp-json/ablocks/v1/form-builder/registrationroute at the WAF. - Check for unfamiliar plugins, modified theme files, and new scheduled tasks.