What is the CVSS score of CVE-2026-57386?

CVE-2026-57386 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of aBlocks are affected by CVE-2026-57386?

The aBlocks WordPress plugin (Kodezen LLC, versions through 2.9.1) contains a privilege escalation vulnerability (CVSS 8.8) enabling authenticated low-privileged users-subscribers and contributors-to…

How to fix or mitigate CVE-2026-57386?

Within 24 hours, audit all WordPress installations for aBlocks plugin presence and version; identify and review all subscriber and contributor-level accounts with recent activity or suspicious behavior. Within 7 days, immediately deactivate aBlocks on all affected WordPress sites, or if deactivation is not operationally feasible, restrict low-privileged user capabilities via WordPress role management to eliminate their access to plugin functionality and implement network-layer access controls limiting subscriber/contributor actions to essential content-only operations. Within 30 days, maintain monitoring of Kodezen LLC security advisories and Patchstack for vendor patch release; evaluate alternative block editor solutions with active maintenance, and conduct forensic review of WordPress audit logs for exploitation attempts during the vulnerability window.

aBlocks CVE-2026-57386

EUVD-2026-43456 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-07-13 Patchstack

WordPress Privilege Escalation Ablocks Wordpress Plugin

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable authenticated action needing only a low-privilege account (PR:L, AC:L, UI:N); privilege escalation to admin yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:02 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.8

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allows Privilege Escalation.This issue affects aBlocks: from n/a through < 2.9.1.

AnalysisAI

Privilege escalation in the aBlocks WordPress plugin (Kodezen LLC) through version 2.9.1 allows an authenticated low-privileged user to elevate their permissions due to incorrect privilege assignment. With a CVSS of 8.8 (AV:N/AC:L/PR:L), a subscriber- or contributor-level account can gain elevated capabilities remotely over the network. No public exploit identified at time of analysis; the issue was disclosed by Patchstack.

Technical ContextAI

aBlocks is a Gutenberg-based page-builder/blocks plugin for WordPress (CPE cpe:2.3:a:kodezen_llc:ablocks). The root cause is CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns capabilities or roles to a user without properly validating the caller's existing privilege level - typically an AJAX/REST action or role-management routine that fails to enforce a capability check (e.g., current_user_can) or nonce/authorization boundary. As a result, WordPress's role and capability model is bypassed, letting a low-tier account acquire capabilities it was never meant to hold.

RemediationAI

Vendor-released patch: aBlocks 2.9.1 - upgrade the plugin to version 2.9.1 or later, which is the primary and definitive fix per the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/ablocks/vulnerability/wordpress-ablocks-plugin-2-9-1-privilege-escalation-vulnerability?_s_id=cve). If immediate patching is not possible, reduce exposure by disabling open user self-registration (Settings > General > 'Anyone can register') to remove the low-privileged foothold the attack depends on, and by deactivating the aBlocks plugin until it can be updated, accepting the trade-off that any pages relying on aBlocks blocks will lose functionality. A WordPress WAF (such as Patchstack's virtual patching) can also be used to block the vulnerable endpoint as a compensating control, with the trade-off of potential false positives on legitimate block-editor requests.