CVE-2026-109934
UnknownSummary
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public. This allows unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
Risk Assessment
An unauthenticated user can access protected content, including WooCommerce coupon codes, potentially leading to financial loss and information disclosure. This undermines the site's access controls.
Recommendation
Update the Otter Blocks plugin to version 3.2.8 or later. On WooCommerce sites, consider invalidating disclosed coupon codes.
Other vulnerabilities in Otter Blocks WordPress plugin
See all- CVE-2026-109936Unknown
The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.
- CVE-2026-109935Unknown
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API. This allows unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
- CVE-2026-109937Medium
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session. This allows unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.
Original NVD description (English source)
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS