# CVE-2026-48877: Tom GenerateBlocks sensitive data exposure

Source: https://junglewise.ai/threats/cve-2026-48877-tom-generateblocks-sensitive-data-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-48877 · Severity: medium · CVSS 6.5 · Published 2026-05-27

GenerateBlocks, a popular layout and design tool for WordPress websites, contains a security flaw that can expose sensitive information. An attacker with basic user permissions could access data that is normally hidden from public view. This information could potentially be used to facilitate further attacks against the website or its users.

Technologies: [GeneratePress GenerateBlocks](https://junglewise.ai/threats/technologies/generateblocks). Vendors: [GeneratePress](https://junglewise.ai/threats/vendors/generatepress).

## Quick answers

**Is CVE-2026-48877 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48877 being exploited in the wild.

**How severe is CVE-2026-48877?** Medium severity, with a CVSS score of 6.5, published 27 May 2026.

**Which products and versions are affected?** GeneratePress GenerateBlocks <= 2.1.0.

**Is there a fix for CVE-2026-48877?** A patch was published on 2026-05-27: Patch released in version 2.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48877 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48877?** Check whether you run GeneratePress GenerateBlocks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The GenerateBlocks plugin for WordPress is vulnerable to the insertion of sensitive information into sent data (CWE-201). This flaw allows an authenticated attacker, typically with 'Contributor' level privileges or higher, to retrieve sensitive data that has been embedded but should not be accessible to their user role. The vulnerability stems from improper handling of sensitive information within the plugin's data output mechanisms. An attacker can exploit this over the network without user interaction to gain unauthorized access to internal site details. The issue is resolved in version 2.1.1.

## Affected products

- Tom Usborne (GeneratePress) GenerateBlocks <= 2.1.0

## Timeline

- 2025-08-03: other: Reported by researcher Abu Hurayra
- 2026-05-27: advisory: Published by Patchstack and NVD
- 2026-05-27: patched: Patch released in version 2.1.1

## References

- [https://patchstack.com/database/wordpress/plugin/generateblocks/vulnerability/wordpress-generateblocks-plugin-2-1-0-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/generateblocks/vulnerability/wordpress-generateblocks-plugin-2-1-0-sensitive-data-exposure-vulnerability?_s_id=cve)

## Related threats

- [GeneratePress GenerateBlocks stored cross-site scripting](https://junglewise.ai/threats/cve-2026-121773-improper-neutralization-of-input-during-web-page-generation)