EUVD-2026-36965
GHSA-c797-w9mm-hhvj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain WordPress contributor account
-
DeliveryAuthenticate to target site
-
ExploitSend crafted request to B Blocks endpoint
-
InstallTrigger incorrect privilege assignment
-
C2Escalate to administrator role
-
ExecuteUpload malicious plugin or theme
-
ImpactExecute code and persist on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Exploitation requires an authenticated WordPress account at Contributor level or above on a site that has the B Blocks plugin installed and active at version 2.0.31 or earlier (PR:L in the CVSS vector). No user interaction by another user is needed (UI:N) and the attack is performed over the network against the WordPress admin/REST interface (AV:N, AC:L). Limiting factors are that the target site must expose user registration or otherwise allow the attacker to obtain contributor credentials, and the B Blocks plugin - not a default WordPress component - must be installed; sites without B Blocks or that restrict account creation to vetted users are not exposed. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent: network-reachable WordPress admin/REST endpoints, low complexity, only contributor-level privilege required, no user interaction, and high impact across the CIA triad through eventual administrative takeover. There is no CISA KEV listing and no EPSS score supplied, and no public proof-of-concept has been identified, so this is a high-severity but not-yet-evidenced-in-the-wild issue. The realistic risk is meaningful because WordPress contributor accounts are commonly handed out to guest authors and freelancers on multi-author sites, and Patchstack-tracked plugin flaws are routinely folded into mass exploitation tooling once a writeup lands - defenders should prioritize patching even without active-exploitation telemetry. Key gaps: no fixed version, EPSS, or KEV data was provided in the input, and the Patchstack advisory page was not retrieved here, so the precise exploitation primitive (REST route, block attribute, or shortcode handler) is not confirmed. |
| Exploit ScenarioDerived | An attacker registers or compromises a low-privileged WordPress Contributor account on a site running B Blocks ≤ 2.0.31 - for example via a guest-author signup flow or credential stuffing. They then send a crafted authenticated request to the vulnerable plugin handler that performs a privileged action without an adequate capability check, granting their account administrator-equivalent rights and allowing arbitrary plugin/theme upload to execute PHP on the host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Privilege escalation in the B Blocks WordPress plugin through version 2.0.31 allows authenticated users with Contributor-level access to elevate their privileges on the affected site. Reported by Patchstack and tracked as EUVD-2026-36965, the issue carries a CVSS 3.1 score of 8.8 reflecting full confidentiality, integrity, and availability impact once a low-privileged WordPress account is obtained. No public exploit identified at time of analysis, but the low attack complexity and lack of required user interaction make weaponization straightforward once an exploitation primitive is published.
RemediationAI
Upstream fix available per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/b-blocks/vulnerability/wordpress-b-blocks-plugin-2-0-31-privilege-escalation-vulnerability; a released patched version is not independently confirmed in the supplied data, so administrators should update B Blocks to the latest release published after 2.0.31 via the WordPress plugin dashboard and verify the installed version is greater than 2.0.31. If an immediate update is not possible, compensating controls are to deactivate the B Blocks plugin (trade-off: any blocks it provides will render as broken in existing posts), tighten contributor onboarding by auditing and removing unneeded contributor/author accounts and forcing password resets, and place the wp-admin and wp-json endpoints behind a WAF or IP allowlist for editorial staff (trade-off: blocks legitimate remote contributors). Monitor user_meta and the wp_users/wp_usermeta tables for unexpected role or capability changes and review recently created administrator accounts as a detection backstop.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
B Blocks (vendor bplugins, CPE cpe:2.3:a:bplugins:b_blocks) is a Gutenberg block-library plugin for WordPress that extends the editor with additional blocks usable by authors and contributors. The root cause is mapped to CWE-266 (Incorrect Privilege Assignment), meaning the plugin grants a user a privilege or capability they should not possess - typically because a plugin endpoint, block render callback, or REST/AJAX handler relies on a permission check that accepts the contributor role (or omits a capability check such as edit_others_posts or manage_options) when performing a privileged action. In WordPress, contributor accounts are intentionally restricted from publishing, editing others' content, or administering the site, so any logic flaw that lets that role write to elevated objects effectively becomes a path to administrator-equivalent control.
Know when B Blocks gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress endpoints (AV:N), no exploit trickery (AC:L), requires a contributor account (PR:L), no victim interaction (UI:N), and privilege escalation to admin yields full CIA impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.
Executive ViewAI
The B Blocks WordPress plugin through version 2.0.31 contains a privilege escalation vulnerability (CVSS 8.8) allowing authenticated users with Contributor-level permissions to gain full administrative access to affected WordPress sites. This creates a critical insider risk: any staff member with content contributor permissions can compromise the entire site's confidentiality, integrity, and availability. Organizations deploying this plugin must immediately assess exposure and enforce interim controls until a vendor patch becomes available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the B Blocks plugin immediately; (2) Audit and restrict Contributor-level role assignments to trusted personnel only; (3) Enable WordPress security event logging with alerting on privilege and role changes; (4) Enforce multi-factor authentication on all administrator accounts; (5) Monitor wp-admin access logs and authentication events for unauthorized attempts; (6) Conduct periodic reviews of WordPress user privileges and remove unnecessary Contributor accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Stored cross-site scripting in the bPlugins B Blocks WordPress plugin (all versions through 2.1.8) lets an authenticated
Improper access control in bPlugins B Blocks versions prior to 2.0.30 allows unauthenticated remote attackers to modify
Exploit-DB