Vulnerabilities / Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks / WPSEC-2026-3107
Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.7.6 - Unauthenticated Sensitive Information Exposure via Block Controls Bypass in Excerpts
Medium 5.3
CWE-200Fixed in 3.7.7
- ID
- WPSEC-2026-3107
- Plugin
- PublishPress Blocks – Block Controls, Block Visibility, Block Permissions (advanced-gutenberg)
- Affected
- all versions before 3.7.7
- Remediation
- Update to 3.7.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks on WPSec AttackSurface
- Fix released
- Published
Description
The PublishPress Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.6 due to blocks hidden by Block Controls (such as user role or schedule rules) not being removed when excerpts are generated from post content, including blocks nested inside wrapper blocks and content shown in the Recent Posts block. This makes it possible for unauthenticated attackers to view the content of blocks that the site owner restricted with Block Controls through auto-generated post excerpts.
References
- https://wpsec.com/vuln/WPSEC-2026-3107/
- https://plugins.svn.wordpress.org/advanced-gutenberg/tags/3.7.7/
- https://wordpress.org/plugins/advanced-gutenberg/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS