Introduction
An attacker can take full administrative control of a WordPress site running B Blocks simply by submitting a crafted registration request. The flaw affects every site using B Blocks up to version 2.0.6, and it requires no authentication. Site integrity and user data are both at risk.
B Blocks is a bPlugins plugin that extends the Gutenberg block editor in WordPress. It adds over 30 custom blocks, and hundreds of sites use it to get more layout and design options without a heavy page builder. Because the plugin is popular and integrates with core WordPress registration flows, this vulnerability hits a broad segment of WordPress users especially hard.
Technical information
CVE-2025-8059 comes from a missing authorization check and improper input validation in the rgfr_registration function of the B Blocks plugin. The function lives in RegisterForm.php and handles the user registration forms submitted through the plugin's registration block.
In all versions up to and including 2.0.6, the function never checks whether the person submitting the registration request is allowed to assign privileged roles. It accepts a role parameter in the request and does not limit it to non-administrative roles. An unauthenticated attacker can therefore submit a registration form with the role parameter set to administrator. The function then creates a new user account with full admin privileges, and none of the intended access controls stop it.
At root, the plugin never calls a WordPress capability-checking function such as current_user_can before it assigns the requested role. It also does not sanitize or validate the incoming role parameter, so the path to privilege escalation is direct.
The relevant code is publicly viewable at:
https://plugins.trac.wordpress.org/browser/b-blocks/trunk/includes/blocks/RegisterForm.php#L77
The vulnerability is classified as CWE-862 (Missing Authorization). Nothing in the code path that creates users restricts role assignment to authorized users.
Affected systems and versions
- Product: B Blocks WordPress plugin
- Affected versions: All versions up to and including 2.0.6
- Vulnerable configuration: Any WordPress site with B Blocks plugin enabled and registration functionality exposed
Vendor security history
bPlugins, the developer of B Blocks, has fixed security issues in this plugin family before. Patchstack and Wordfence advisories list earlier vulnerabilities, including cross-site scripting flaws, that were patched in prior releases. The vendor has shipped updates after past disclosures, but a critical privilege escalation flaw in the registration logic points to ongoing trouble with implementing user management features securely.
