CVE-2026-109934: Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API

Q: What information could an unauthenticated attacker retrieve?

They may retrieve manual excerpts from password-protected posts, as well as the titles and content of non-public post types. On sites using WooCommerce, coupon codes and their descriptions may also be exposed.

Q: Is authentication required to exploit this issue?

No. The affected REST API endpoint can disclose the affected data to unauthenticated users.

Q: Which plugin versions are affected?

Otter Blocks versions before 3.2.8 are affected; the reported affected range is 3.1.1 through 3.2.7.

Q: What condition causes content to be exposed?

The plugin incorrectly treats any post with published status as publicly readable when serving data from the REST API endpoint, without correctly determining whether the post is actually public.

Published Oct 23, 2026

Updated

The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.

Affected Software

1 affected component

Themeisle Otter Blocks>=3.1.1<=3.2.7

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What information could an unauthenticated attacker retrieve?

They may retrieve manual excerpts from password-protected posts, as well as the titles and content of non-public post types. On sites using WooCommerce, coupon codes and their descriptions may also be exposed.

Is authentication required to exploit this issue?

No. The affected REST API endpoint can disclose the affected data to unauthenticated users.

Which plugin versions are affected?

Otter Blocks versions before 3.2.8 are affected; the reported affected range is 3.1.1 through 3.2.7.

What condition causes content to be exposed?

The plugin incorrectly treats any post with published status as publicly readable when serving data from the REST API endpoint, without correctly determining whether the post is actually public.

CVE-2026-109934: Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API

Affected Software

Event History

Frequently Asked Questions

What information could an unauthenticated attacker retrieve?

Is authentication required to exploit this issue?

Which plugin versions are affected?

What condition causes content to be exposed?

Company

Resources

Contact

Frequently Asked Questions

What information could an unauthenticated attacker retrieve?

Is authentication required to exploit this issue?

Which plugin versions are affected?

What condition causes content to be exposed?