{"id":"CVE-2026-125819","kind":"vulnerability","aliases":["CVE-2026-125819"],"related":[],"title":"PublishPress Gutenberg Blocks: missing authorization check lets users bypass access controls","description":"Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6.","summary":"PublishPress Gutenberg Blocks (advanced-gutenberg) has a missing authorization check that allows exploiting incorrectly configured access control levels. The affected versions are all releases through 3.7.6.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gutenberg-blocks","package","publishpress","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Gutenberg Blocks plugin in the WordPress admin under Plugins, or in `wp-content/plugins/advanced-gutenberg`.\n- Treat any version through `3.7.6` as affected.","fix":null,"status":"open","published_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","triaged_at":"2026-11-13T15:49:02+00:00","updated_at":"2026-11-13T15:49:02+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T15:49:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"PublishPress Gutenberg Blocks: missing authorization check lets users bypass access controls","impact":"medium","summary":"PublishPress Gutenberg Blocks (advanced-gutenberg) has a missing authorization check that allows exploiting incorrectly configured access control levels. The affected versions are all releases through 3.7.6.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","gutenberg-blocks","publishpress"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Users reach block or content functions their access settings should block","analyst_note":"Check the NVD entry and the vendor changelog for the fixed version and the required privilege level.","how_to_check":"- Check the installed version of the Gutenberg Blocks plugin in the WordPress admin under Plugins, or in `wp-content/plugins/advanced-gutenberg`.\n- Treat any version through `3.7.6` as affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the PublishPress Gutenberg Blocks (advanced-gutenberg) WordPress plugin at version 3.7.6 or earlier. The flaw concerns access control settings, so sites that rely on custom role or block restrictions are the most relevant. The sources do not say what the minimum privilege needed is.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4552,"output_tokens":550,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125819':14A,17A '-2026':13A,16A '3.7.6':50B,76C 'access':10A,40B,65C 'advanc':28B,59C 'advanced-gutenberg':27B,58C 'affect':44B,70C 'allow':36B,61C 'author':5A,33B,52C 'block':3A,20B,26B,57C,72C 'bypass':9A 'check':6A,34B 'configur':39B,64C 'control':11A,41B,66C 'cve':12A,15A 'exploit':37B,62C 'gutenberg':2A,19B,25B,29B,56C,60C,71C 'gutenberg-block':18B 'incorrect':38B,63C 'issu':69C 'let':7A 'level':42B 'levels.this':68C 'miss':4A,32B,51C 'n/a':74C 'packag':21B 'publishpress':1A,22B,24B,55C 'releas':48B 'secur':67C 'user':8A 'version':45B 'vulner':53C 'wordpress':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the PublishPress Gutenberg Blocks (advanced-gutenberg) WordPress plugin at version 3.7.6 or earlier. The flaw concerns access control settings, so sites that rely on custom role or block restrictions are the most relevant. The sources do not say what the minimum privilege needed is.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gutenbergblocks","medium","package","publishpress","wordpress"],"campaign_type":null,"search_a":"'-125819':14A,17A '-2026':13A,16A 'access':10A 'author':5A 'block':3A 'bypass':9A 'check':6A 'control':11A 'cve':12A,15A 'gutenberg':2A 'let':7A 'miss':4A 'publishpress':1A 'user':8A","search_b":"'3.7.6':50B 'access':40B 'advanc':28B 'advanced-gutenberg':27B 'affect':44B 'allow':36B 'author':33B 'block':20B,26B 'check':34B 'configur':39B 'control':41B 'exploit':37B 'gutenberg':19B,25B,29B 'gutenberg-block':18B 'incorrect':38B 'level':42B 'miss':32B 'packag':21B 'publishpress':22B,24B 'releas':48B 'version':45B 'wordpress':23B","search_c":"'3.7.6':76C 'access':65C 'advanc':59C 'advanced-gutenberg':58C 'affect':70C 'allow':61C 'author':52C 'block':57C,72C 'configur':64C 'control':66C 'exploit':62C 'gutenberg':56C,60C,71C 'incorrect':63C 'issu':69C 'levels.this':68C 'miss':51C 'n/a':74C 'publishpress':55C 'secur':67C 'vulner':53C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125819","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125819","severity":null,"published_at":"2026-11-13T15:17:41+00:00","modified_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","fetched_at":"2026-11-13T15:46:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}