# Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.7.6 - Unauthenticated Sensitive Information Exposure via Block Controls Bypass in Excerpts

- **ID:** WPSEC-2026-3107
- **Plugin:** PublishPress Blocks – Block Controls, Block Visibility, Block Permissions (`advanced-gutenberg`), https://wordpress.org/plugins/advanced-gutenberg/
- **Affected versions:** all versions before 3.7.7
- **Fixed in:** 3.7.7 (Update to 3.7.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/advanced-gutenberg
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3107/

## Description

The PublishPress Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.6 due to blocks hidden by Block Controls (such as user role or schedule rules) not being removed when excerpts are generated from post content, including blocks nested inside wrapper blocks and content shown in the Recent Posts block. This makes it possible for unauthenticated attackers to view the content of blocks that the site owner restricted with Block Controls through auto-generated post excerpts.

## References

- https://wpsec.com/vuln/WPSEC-2026-3107/
- https://plugins.svn.wordpress.org/advanced-gutenberg/tags/3.7.7/
- https://wordpress.org/plugins/advanced-gutenberg/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3107/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.