Live › vulnerability › CVE-2026-109934
Go to dashboardThe Otter Blocks WordPress plugin before 3.2.8 returns data for posts it wrongly treats as public, through a REST API endpoint. An unauthenticated visitor can read excerpts of password-protected posts, content of non-public post types, and on WooCommerce sites, coupon codes and descriptions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites running Otter Blocks before 3.2.8 are exposed, and the risk is higher when password-protected posts, private custom post types, or WooCommerce coupons exist. Sites that do not run the plugin, or have already updated, can skip it.
No product ranges from the sources yet.
wp plugin get otter-blocks --field=version3.2.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
This page as .md · .json · in your agent: get_signal("CVE-2026-109934")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.