The vulnerability resides in the Otter Blocks WordPress plugin versions earlier than 3.2.8. When a published post is retrieved through the WordPress REST API, the plugin fails to enforce the block visibility conditions set by the site owner. As a result, unauthenticated users can read block content that is meant to be restricted to specific roles, logged‑in users, post authors, categories, tags, or Stripe purchasers on the Pro tier. This constitutes an exposure of confidential information that should remain hidden.

Any WordPress site that has the Otter Blocks plugin installed with a version older than 3.2.8 is affected. The flaw applies to both the standard and Pro editions, impacting blocks whose visibility is limited by role, logged‑in status, author, taxonomy terms, or Stripe purchase. Sites that expose their posts via the REST API are at risk.

The defect is exploitable through the public WordPress REST API, which requires no authentication. An attacker can perform a simple GET request to the REST endpoint and retrieve the full rendered post, including hidden blocks. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation. However, the CVSS score of 5.3 reflects medium severity, as the disclosure of restricted content may compromise confidentiality and potentially impact the site's reputation.