Live › vulnerability › CVE-2026-109935
Go to dashboardThe Otter Blocks WordPress plugin before 3.2.8 does not apply its block visibility rules when a published post is rendered through the WordPress REST API. An unauthenticated visitor can read content the site owner hid from them, including content limited to specific roles, logged-in users, categories, tags, or Stripe purchasers on the Pro tier.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Otter Blocks before 3.2.8 that use its block visibility conditions to hide content from some visitors. Sites that do not use visibility conditions are not exposed by this flaw, and the Pro tier adds the Stripe purchaser condition as another path to the same exposure.
No product ranges from the sources yet.
wp plugin get otter-blocks --field=version/wp-json/wp/v2/posts/<id> to see if the restricted block content appears3.2.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
This page as .md · .json · in your agent: get_signal("CVE-2026-109935")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.