Is CVE-2026-110018 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110018 being exploited in the wild.

How severe is CVE-2026-110018?

High severity, with a CVSS score of 8.8, published 24 October 2026.

Is there a fix for CVE-2026-110018?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-110018 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-110018?

Check whether you run aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder or Form Builder & Animation Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110018: aBlocks Gutenberg Blocks privilege escalation in form-builder endpoint

CVE-2026-110018 · Severity: high · CVSS 8.8 · Published 2026-10-24

The aBlocks WordPress plugin contains a flaw in its form builder REST endpoint that allows authenticated Contributors to escalate their account to Editor level or higher. An attacker can exploit a missing permission check to set an arbitrary user role via a login form block saved with a malicious role attribute, then trigger the vulnerable endpoint to elevate their privileges and gain full access to site editing capabilities.

Technologies: aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder. Vendors: aBlocks.

Quick answers

Is CVE-2026-110018 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110018 being exploited in the wild.
How severe is CVE-2026-110018?: High severity, with a CVSS score of 8.8, published 24 October 2026.
Which products and versions are affected?: aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder up to and including 2.17.0.
Is there a fix for CVE-2026-110018?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-110018 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-110018?: Check whether you run aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder or Form Builder & Animation Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The `/ablocks/v1/form-builder/registration` REST endpoint is registered with no permission callback and fails to validate that the block's formType matches the expected `registration` mode before processing the roleSlug parameter from post content. An authenticated Contributor can preserve an arbitrary roleSlug by saving a login-type form block and then invoking the endpoint with a valid nonce and post-ownership check, causing WP_User::set_role() to be called at the elevated privilege level. The vulnerability is bounded by is_safe_registration_role() which prevents promotion to administrator.

Affected products

ablocks aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder up to and including 2.17.0

Timeline

2026-10-24: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.