The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the /ablocks/v1/form-builder/registration REST endpoint. The vulnerability exists because the endpoint is registered with permissioncallback => returntrue and the register() handler reads roleSlug directly from attacker-controlled block attributes in postcontent without ever verifying that the block's formType is registration — a condition that RegistrationFormSanitizer::verify() imposes only at save-time, meaning a Contributor can preserve an arbitrary roleSlug by saving a block with formType='login' and then triggering the endpoint via a valid wprest nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via WPUser::setrole() and wpsetauthcookie(). Escalation is bounded below administrator-tier roles because issaferegistrationrole() rejects any role holding manageoptions, editusers, deleteusers, createusers, promoteusers, or editthemeoptions, meaning the highest practically reachable role on a standard WordPress installation is Editor.