CVE-2026-109935
CVE-2026-109935 · Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
CVSS 5.3 · Moyenne · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
otter blocks
- Versions du logiciel
- ≥ 0, < 3.2.8: Concernée (semver)
Mettez à jour vers 3.2.8