{
 "id": "WPSEC-2026-3107",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3107/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3107/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3107/index.md",
 "title": "Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.7.6 - Unauthenticated Sensitive Information Exposure via Block Controls Bypass in Excerpts",
 "description": "The PublishPress Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.6 due to blocks hidden by Block Controls (such as user role or schedule rules) not being removed when excerpts are generated from post content, including blocks nested inside wrapper blocks and content shown in the Recent Posts block. This makes it possible for unauthenticated attackers to view the content of blocks that the site owner restricted with Block Controls through auto-generated post excerpts.",
 "plugin": {
  "slug": "advanced-gutenberg",
  "name": "Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks",
  "full_name": "PublishPress Blocks – Block Controls, Block Visibility, Block Permissions",
  "wordpress_org": "https://wordpress.org/plugins/advanced-gutenberg/",
  "advisories_url": "https://wpsec.com/vuln/plugin/advanced-gutenberg/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/advanced-gutenberg"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.7.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.7.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.7.7",
 "remediation": "Update to 3.7.7 or later.",
 "fix_released": "2026-11-12T19:12:12+00:00",
 "published": "2026-11-13T19:41:14+00:00",
 "updated": "2026-11-13T15:54:44.203516+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3107/",
  "https://plugins.svn.wordpress.org/advanced-gutenberg/tags/3.7.7/",
  "https://wordpress.org/plugins/advanced-gutenberg/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/advanced-gutenberg",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}