CVE-2026-125819: WordPress Gutenberg Blocks plugin <= 3.7.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.7
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects PublishPress Gutenberg Blocks (advanced-gutenberg) versions through 3.7.6. The available data does not identify a lower affected version boundary.
Can an unauthenticated attacker exploit this remotely?
The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. The reported impact is limited to confidentiality loss; integrity and availability impacts are not indicated.