CVE-2026-121771: WordPress Gutenberg Blocks plugin <= 3.7.6 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Gutenberg Blocks: from n/a through 3.7.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.7
Event History
Frequently Asked Questions
Which deployments are exposed?
Sites using Gutenberg Blocks (the advanced-gutenberg plugin) are affected through version 3.7.6. The affected version range begins at an unspecified earlier version.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected impact?
An attacker may retrieve embedded sensitive data sent by the affected plugin. The reported impact is limited to confidentiality; integrity and availability are not affected.