Block Visibility Bypass in Otter Blocks Plugin for WordPress
CVE-2026-109935
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 October 2026
Badges
What is CVE-2026-109935?
The Otter Blocks WordPress plugin, prior to version 3.2.8, fails to properly enforce block visibility conditions when rendering published posts via the WordPress REST API. This oversight allows unauthenticated users to access content that should be restricted to specific user roles, such as site owners, logged-in users, post authors, or specific categories and tags. In the Pro version, even access based on financial transactions (Stripe purchasers) can be compromised. This vulnerability presents a significant risk as it may expose sensitive content intended for restricted audiences.
Affected Version(s)
Otter Blocks 0 < 3.2.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.