The plugin allows an attacker with Contributor-level access to manipulate the roleSlug attribute. By saving a block with formType='login' and subsequently triggering the registration endpoint, the attacker can bypass validation checks that only occur during the save process. The vulnerability is mitigated for administrator-level roles by an is_safe_registration_role() function that rejects roles with critical management capabilities, limiting escalation to the Editor role or lower.

Impact

Successful exploitation allows an authenticated user with at least Contributor-level access to escalate their account privileges to Editor. This provides the attacker with elevated access to site content and administrative capabilities associated with the Editor role.

Recommendation

• Update the "aBlocks - Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder" plugin to a version released after 2.17.0.
• Audit existing user accounts for unexpected elevation to Editor or other high-privilege roles.
• Review WordPress REST API logs for anomalous requests to the /ablocks/v1/form-builder/registration endpoint, particularly from users with Contributor-level roles.