CVE-2025-8059: Critical Privilege Escalation Vulnerability in B Blocks WordPress Plugin

Overview

WordPress, the most popular Content Management System (CMS) globally, is at the helm of managing countless websites, from personal blogs to corporate sites. However, its expansive plugin ecosystem often brings along security vulnerabilities that can compromise the security of these websites. This blog post focuses on one such critical vulnerability (CVE-2025-8059) found in the B Blocks WordPress Plugin.
The B Blocks plugin, susceptible to Privilege Escalation, has a vulnerability due to missing authorization and inappropriate input validation in the rgfr_registration() function. This vulnerability can provide unauthenticated attackers a playground to create a new account and assign it the administrator role, escalating the risk of potential system compromise or data leakage.

Vulnerability Summary

CVE ID: CVE-2025-8059
Severity: Critical (CVSS: 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

B Blocks WordPress Plugin | Up to and including 2.0.6

How the Exploit Works

The vulnerability centers around the rgfr_registration() function. This function, designed to manage user registrations, lacks proper authorization checks and input validation. Therefore, an attacker can exploit this function to register a new user account with elevated privileges, without any authentication.
The missing authorization allows an attacker to access the function without being a registered user, while the improper input validation permits the attacker to manipulate the registration data, enabling them to assign the newly registered account the administrator role.

Conceptual Example Code

Here is a
conceptual
example of how the vulnerability might be exploited. This is a sample HTTP POST request, which an attacker could use to register a new user with administrator privileges:

POST /wp-json/bblocks/v1/register HTTP/1.1
Host: target.example.com
Content-Type: application/json
{
"username": "attacker",
"password": "password123",
"email": "attacker@example.com",
"role": "administrator"
}

In this example, the attacker is creating a new WordPress user with the username “attacker”, password “password123”, and email “attacker@example.com”. The “role” parameter is set to “administrator”, which would be overlooked by the vulnerable rgfr_registration() function, thereby granting the attacker account administrative privileges.