aBlocks EUVD-2026-43456

Requires an authenticated account on the target WordPress site (CVSS PR:L), so the attacker must already hold at least a low-privilege role such as subscriber or contributor - commonly obtainable where open registration is enabled. No user interaction is needed (UI:N) and the attack is fully network-based (AV:N/AC:L) against the vulnerable aBlocks plugin (versions below 2.9.1). Exploitation is limited on sites that disable public registration or otherwise restrict account creation, since the attacker cannot obtain the required low-privileged foothold. The exact vulnerable feature/endpoint is not detailed in the provided data beyond the incorrect-privilege-assignment (CWE-266) root cause.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high impact across confidentiality, integrity, and availability - consistent with full site compromise once a foothold account exists. No EPSS score, KEV listing, or POC was provided in the input, so this is a high-CVSS finding without confirmed real-world exploitation signal. The practical gating factor is PR:L: an attacker needs an existing authenticated account, which is realistic on sites that permit open registration (subscriber/contributor roles) but not on locked-down installations. Absent EPSS/KEV data, treat this as a serious priority for sites with self-registration, and moderate for tightly controlled sites.

An attacker registers or obtains a low-privilege account (e.g., subscriber or contributor) on a WordPress site running a vulnerable aBlocks version, then sends a crafted request to the plugin's privilege-assignment functionality to grant their own account administrator-level capabilities. Given AV:N/AC:L/UI:N, this requires no victim interaction and low effort; no public POC has been identified at time of analysis.