CVE-2026-109934: CWE-200 Information Exposure in Otter Blocks
Description
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
CVSS v3.1
Score 5.3medium
Affected software
Otter Blocks
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Otter Blocks WordPress plugin before version 3.2.8 contains an information exposure vulnerability (CWE-200) due to incorrect access control checks on a REST API endpoint. The plugin assumes that any post marked as published is publicly readable, failing to verify actual post visibility. This flaw allows unauthenticated users to retrieve sensitive data including manual excerpts of password-protected posts, non-public post content and titles, and WooCommerce coupon codes and descriptions.
Potential Impact
Unauthenticated attackers can access sensitive information that should be restricted, such as excerpts from password-protected posts, content and titles of non-public posts, and WooCommerce coupon codes. This exposure could lead to information disclosure that may facilitate further attacks or unauthorized use of coupons.
Mitigation Recommendations
Users should upgrade Otter Blocks to version 3.2.8 or later, where this vulnerability is fixed. No other mitigation is indicated. Patch status is confirmed by the version range affected and the fixed version 3.2.8.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-13T11:14:42.350Z
- State
- PUBLISHED
Threat ID: 6adafb984d27ba8daad7777f
Added to database: 10/23/2026, 06:15:52 UTC
Last enriched: 10/23/2026, 06:31:20 UTC
Last updated: 10/23/2026, 11:16:08 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.