Description
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
Published: 2026-10-23
Score: n/a
EPSS: n/a
KEV: No
Impact: Unauthenticated Content Disclosure
Action: Patch
AI Analysis

Impact

The Otter Blocks WordPress plugin fails to verify whether a post has public read permissions before returning data through a REST API endpoint. As a result, unauthenticated users can retrieve excerpts, full content, and titles of password‑protected or otherwise non‑public posts, and on WooCommerce sites can also obtain coupon codes and descriptions.

Affected Systems

WordPress sites that have Otter Blocks plugin versions 3.1.1 through 3.2.7 are vulnerable. These releases do not include the access‑control check introduced in 3.2.8.

Risk and Exploitability

The vulnerability can be triggered by simply making a REST API request without any authentication. No EPSS score is published, and the issue is not listed in the CISA KEV catalog, but the lack of access control permits unauthenticated disclosure of sensitive content.

Generated by OpenCVE AI on October 23, 2026 at 07:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Otter Blocks to version 3.2.8 or later, which restores the correct access‑control logic.
  • If an update is not immediately possible, disable the REST API endpoint that exposes post data or deactivate the plugin temporarily to prevent unauthenticated access.
  • On WooCommerce sites, review coupon visibility settings and rely on a security plugin that restricts REST API access to authenticated users only, to avoid exposing coupon data.

Generated by OpenCVE AI on October 23, 2026 at 07:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions otter Blocks
Vendors & Products Wordpress-extensions
Wordpress-extensions otter Blocks

Fri, 23 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Fri, 23 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
Title Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API
References

Subscriptions

Wordpress-extensions Otter Blocks
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-23T06:00:17.759Z

Reserved: 2026-10-13T11:14:42.350Z

Link: CVE-2026-109934

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T06:17:05.283

Modified: 2026-10-23T06:17:05.283

Link: CVE-2026-109934

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T08:45:16Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control