Quick answers
- Is CVE-2026-48877 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48877 being exploited in the wild.
- How severe is CVE-2026-48877?
- Medium severity, with a CVSS score of 6.5, published 27 May 2026.
- Which products and versions are affected?
- GeneratePress GenerateBlocks <= 2.1.0.
- Is there a fix for CVE-2026-48877?
- A patch was published on 2026-05-27: Patch released in version 2.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48877 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-48877?
- Check whether you run GeneratePress GenerateBlocks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The GenerateBlocks plugin for WordPress is vulnerable to the insertion of sensitive information into sent data (CWE-201). This flaw allows an authenticated attacker, typically with 'Contributor' level privileges or higher, to retrieve sensitive data that has been embedded but should not be accessible to their user role. The vulnerability stems from improper handling of sensitive information within the plugin's data output mechanisms. An attacker can exploit this over the network without user interaction to gain unauthorized access to internal site details. The issue is resolved in version 2.1.1.
Affected products
- Tom Usborne (GeneratePress) GenerateBlocks <= 2.1.0
Timeline
- 2025-08-03: other: Reported by researcher Abu Hurayra
- 2026-05-27: advisory: Published by Patchstack and NVD
- 2026-05-27: patched: Patch released in version 2.1.1