CVE-2026-109935
UnknownSummary
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API. This allows unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
Risk Assessment
An unauthenticated user can access content that was meant to be restricted, resulting in information disclosure. This may expose data intended only for selected audiences.
Recommendation
Update the Otter Blocks plugin to version 3.2.8 or later. Check whether restricted content has been disclosed.
Other vulnerabilities in Otter Blocks WordPress plugin
See all- CVE-2026-109936Unknown
The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.
- CVE-2026-109934Unknown
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public. This allows unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
- CVE-2026-109937Medium
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session. This allows unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.
Original NVD description (English source)
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS