Improper Authentication in Otter Blocks WordPress Plugin Exposes Sensitive Data
CVE-2026-109934
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 October 2026
Badges
What is CVE-2026-109934?
The Otter Blocks WordPress plugin, prior to version 3.2.8, has a critical flaw in its REST API endpoint functionality. It fails to properly verify the visibility status of posts, leading to exposure of sensitive content. This includes manual excerpts from password-protected posts, the content of non-public post types, and potentially compromising coupon codes and their descriptions on WooCommerce sites. As a result, unauthenticated users can access data that should remain private, creating significant security risks for site owners and their users.
Affected Version(s)
Otter Blocks 3.1.1 < 3.2.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.