---
id: "CVE-2026-109934"
kind: "vulnerability"
aliases: ["CVE-2026-109934"]
title: "Otter Blocks WordPress plugin leaks protected post content through REST API"
severity: "medium"
cvss: 5.3
epss: 0.00146
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["otter-blocks", "package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-updated-to-3.2.8"]
published_at: "2026-10-23T06:17:05+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:18:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109934", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-109934", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Otter Blocks WordPress plugin leaks protected post content through REST API

The Otter Blocks WordPress plugin before 3.2.8 returns data for posts it wrongly treats as public, through a REST API endpoint. An unauthenticated visitor can read excerpts of password-protected posts, content of non-public post types, and on WooCommerce sites, coupon codes and descriptions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Otter Blocks plugin version in the WordPress admin Plugins screen or with `wp plugin get otter-blocks --field=version`
- Confirm whether WooCommerce is active on the site, since coupon exposure depends on it

## Fix

- Update the Otter Blocks plugin to `3.2.8` or later
- If WooCommerce coupons were public, rotate any exposed coupon codes

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109934
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-109934

## From the sources

The Otter Blocks  WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_