CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to create a new account and assign it the administrator role.
Explanation of Vulnerability in Simple Terms
bBlocks – Essential Gutenberg Blocks & Patterns Collection versions 2.0.6 and earlier lack proper authorization checks. An unauthenticated attacker can read, modify, or delete site data without permission. This affects all installations of the plugin. Update immediately to a version newer than 2.0.6.
What an attacker can do
Read, modify, or delete site data without any authentication or user interaction.
Potential impact on your site
Attackers can compromise your site's data, content, and configuration without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
