CVE-2026-109934
CVE-2026-109934 · Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
CVSS 5.3 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Affected products and versions
otter blocks
- Versions
- ≥ 3.1.1, < 3.2.8: Affected (semver)
Update to 3.2.8