CVE-2026-109935: Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API

Q: Who can exploit this issue?

Any unauthenticated user who can access the WordPress REST API can potentially retrieve restricted block content from published posts. No account or privileged role is required.

Q: Which visibility restrictions may be bypassed?

Content restricted to specific roles, logged-in users, the post author, categories, or tags may be disclosed. On the Pro tier, content restricted to Stripe purchasers may also be exposed.

Q: When is restricted content exposed?

The issue occurs when a published post is rendered through the WordPress REST API. The plugin does not enforce its block visibility conditions in that rendering path.

Q: What versions are affected?

Otter Blocks versions before 3.2.8 are affected.

Published Oct 23, 2026

Updated

The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.

Affected Software

1 affected component

Themeisle Otter Blocks<3.2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Otter Blocks to a version that resolves this vulnerability.
Fixed in 3.2.8

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated user who can access the WordPress REST API can potentially retrieve restricted block content from published posts. No account or privileged role is required.

Which visibility restrictions may be bypassed?

Content restricted to specific roles, logged-in users, the post author, categories, or tags may be disclosed. On the Pro tier, content restricted to Stripe purchasers may also be exposed.

When is restricted content exposed?

The issue occurs when a published post is rendered through the WordPress REST API. The plugin does not enforce its block visibility conditions in that rendering path.

What versions are affected?

Otter Blocks versions before 3.2.8 are affected.

CVE-2026-109935: Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which visibility restrictions may be bypassed?

When is restricted content exposed?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which visibility restrictions may be bypassed?

When is restricted content exposed?

What versions are affected?