PublishPress Gutenberg Blocks up to version 3.3.1 contains improper control of filename for include/require, allowing local file inclusion. A remote attacker controlling the filename parameter could cause PHP to include arbitrary local files, potentially leading to remote code execution or disclosure of sensitive files. This is a CWE‑98 flaw.

The affected vendor is PublishPress, product Gutenberg Blocks (advanced‑gutenberg) for WordPress. Versions from the initial release through 3.3.1 are impacted. No specific patch version is listed; guidance points to upgrading beyond 3.3.1.

The CVSS score of 7.5 indicates high severity. The EPSS score is under 1 %, suggesting low current exploitation probability. The vulnerability is not in the CISA KEV catalog. Attackers would need to craft a request that manipulates the filename variable, likely via query string or form input, and may require sufficient WordPress privileges, though the description does not specify. As the flaw is a local inclusion, an attacker could read or execute files on the server, depending on context.