The vulnerability in Themeisle Otter – Gutenberg Block allows an attacker to retrieve sensitive information that the plugin may embed into data sent from a WordPress site. This flaw can expose confidential content to unauthorized users, compromising the confidentiality of site data. The weakness is classified as CWE‑201, indicating that sensitive data is improperly handled and exposed.

WordPress installations that have the Otter – Gutenberg Block plugin version 3.1.0 or earlier are affected. All sites using the plugin in the specified version range, regardless of user role or site configuration, could be impacted.

The CVSS score of 7.5 reflects significant risk to confidentiality, while the EPSS score of less than 1% indicates a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote through web requests that the plugin processes, but the CVE description does not explicitly state the exploitation method. Based on the exposed data handling flaw, an attacker could retrieve sensitive content by interacting with the plugin’s output or embedded data representations.