{"id":"CVE-2026-109935","kind":"vulnerability","aliases":["CVE-2026-109935"],"related":[],"title":"Otter Blocks WordPress plugin: hidden block content readable through REST API","description":"The Otter Blocks  WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.","summary":"The Otter Blocks WordPress plugin before 3.2.8 does not apply its block visibility rules when a published post is rendered through the WordPress REST API. An unauthenticated visitor can read content the site owner hid from them, including content limited to specific roles, logged-in users, categories, tags, or Stripe purchasers on the Pro tier.","severity":"medium","cvss":null,"epss":0.00146,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["otter-blocks","package","self-hosted","wordpress"],"not_affected_if":["default-config","no-visibility-conditions"],"how_to_check":"- Check the installed Otter Blocks version in the WordPress admin plugins list or with `wp plugin get otter-blocks --field=version`\n- Look for posts that use Otter Blocks visibility conditions and request them anonymously at `/wp-json/wp/v2/posts/<id>` to see if the restricted block content appears","fix":"- Update Otter Blocks to `3.2.8` or later\n- If you cannot update yet, move restricted content out of posts or disable the plugin's visibility conditions","status":"open","published_at":"2026-10-23T06:17:05+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T05:00:20+00:00","updated_at":"2026-10-25T05:00:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:00:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update Otter Blocks to `3.2.8` or later\n- If you cannot update yet, move restricted content out of posts or disable the plugin's visibility conditions","reach":"internet","title":"Otter Blocks WordPress plugin: hidden block content readable through REST API","impact":"medium","summary":"The Otter Blocks WordPress plugin before 3.2.8 does not apply its block visibility rules when a published post is rendered through the WordPress REST API. An unauthenticated visitor can read content the site owner hid from them, including content limited to specific roles, logged-in users, categories, tags, or Stripe purchasers on the Pro tier.","category":"package","nicknames":[],"who_cares":["wordpress","otter-blocks","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Anonymous visitors read content meant only for logged-in users or buyers","analyst_note":"","how_to_check":"- Check the installed Otter Blocks version in the WordPress admin plugins list or with `wp plugin get otter-blocks --field=version`\n- Look for posts that use Otter Blocks visibility conditions and request them anonymously at `/wp-json/wp/v2/posts/<id>` to see if the restricted block content appears","needs_analyst":false,"not_affected_if":["default-config","no-visibility-conditions"],"who_is_affected":"Sites running Otter Blocks before 3.2.8 that use its block visibility conditions to hide content from some visitors. Sites that do not use visibility conditions are not exposed by this flaw, and the Pro tier adds the Stripe purchaser condition as another path to the same exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":3370,"output_tokens":607,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-109935':14A,17A '-2026':13A,16A '3.2.8':32B,88C 'allow':107C 'api':11A,50B,106C 'appli':35B 'author':128C 'block':2A,6A,20B,28B,37B,84C,93C,112C 'categori':73B,129C 'condit':95C 'content':7A,56B,64B,113C 'cve':12A,15A 'enforc':91C 'hid':60B 'hidden':5A 'host':24B 'includ':63B 'limit':65B 'log':70B,123C 'logged-in':69B,122C 'otter':1A,19B,27B,83C 'otter-block':18B 'owner':59B,117C 'packag':21B 'plugin':4A,30B,86C 'post':43B,99C,127C 'pro':80B,135C 'publish':42B,98C 'purchas':77B,138C 'read':55B,111C 'readabl':8A 'render':45B,101C 'rest':10A,49B,105C 'restrict':118C 'role':68B,121C 'rule':39B 'self':23B 'self-host':22B 'site':58B,116C 'specif':67B,120C 'stripe':76B,137C 'tag':74B,131C 'tier':81B,136C 'unauthent':52B,108C 'user':72B,109C,125C 'visibl':38B,94C 'visitor':53B 'wordpress':3A,25B,29B,48B,85C,104C","nicknames":[],"mitigations":[],"who_affected":"Sites running Otter Blocks before 3.2.8 that use its block visibility conditions to hide content from some visitors. Sites that do not use visibility conditions are not exposed by this flaw, and the Pro tier adds the Stripe purchaser condition as another path to the same exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T06:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109935","severity":null,"published_at":"2026-10-23T06:17:05+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-109935","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109935","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}