This vulnerability occurs in the Otter Blocks WordPress plugin in versions earlier than 3.2.8 when a published post is accessed through the WordPress REST API. The plugin does not enforce the block visibility settings configured by the site owner, allowing any unauthenticated user to retrieve block content that is meant to be hidden from generic visitors, roles, logged‑in users, post authors, certain categories or tags, or (in the Pro tier) Stripe purchasers. The result is a direct breach of confidentiality, exposing information that should remain restricted.

WordPress sites that have the Otter Blocks plugin installed with a version earlier than 3.2.8. The flaw applies to both the standard and Pro tiers, affecting any block whose visibility is limited by role, logged‑in status, author, taxonomy term or Stripe purchase.

The defect is exploitable via the public WordPress REST API, which is reachable by anyone without authentication. An attacker can issue a simple GET request to the REST endpoint delivering the full rendered post, thereby reading hidden blocks. EPSS data is not available and the vulnerability is not listed in CISA KEV, but the potential for widespread information disclosure places it in a high‑risk category for affected sites. No CVSS score is published, yet the impact of unauthorized data exposure warrants urgent attention.