CVE-2026-39579: WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability

Synopsis

This is a privilege escalation vulnerability in the B Blocks WordPress plugin, versions 2.0.31 and earlier. An attacker reachable over the network with only a low-privilege (Contributor-level) account can exploit this flaw without any victim interaction. Successful exploitation lets the attacker elevate their permissions within the WordPress installation, gaining capabilities far beyond those of a standard Contributor account. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so the attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account (Contributor level is sufficient) on the target WordPress site.

• Victim interactionNot required

  No victim action is needed; the attacker triggers the vulnerability directly without involving any other user.

• Attack complexityDetail

  Exploitation is reliable and condition-free, requiring no race conditions, special memory layout, or environmental prerequisites.

Blast Radius

• The attacker elevates their WordPress role beyond Contributor, gaining write or administrative capabilities they were not granted.
• With elevated privileges, the attacker can modify, publish, or delete site content and install or alter plugins and themes.
• High confidentiality impact means the attacker can read protected site data, including user records, private posts, and stored credentials.
• The availability of the service is at risk, as a privileged attacker can deactivate plugins, corrupt configuration, or otherwise disrupt normal site operation.