{"id":"CVE-2026-109934","title":"Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API","summary":"The Otter Blocks  WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unaut…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"adp","cwe":["CWE-200"],"product":"Otter Blocks","affected":["otter_blocks >= 3.1.1 < 3.2.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-23T10:39:30.862438Z"},"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T10:46:04.839Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109934","references":[{"url":"https://wpscan.com/vulnerability/f634bde0-bfb0-4bf9-9c85-fb72763c5dfd/"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T06:17:25.175Z","slug":"CVE-2026-109934","body":"## Overview\n\nThe Otter Blocks  WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.\n\n## Affected\n\n- `otter_blocks >= 3.1.1 < 3.2.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228009,"id":"CVE-2026-109934","ts":1792754645627,"field":"cvss","old":null,"new":"5.3"},{"seq":228008,"id":"CVE-2026-109934","ts":1792754645627,"field":"severity","old":"none","new":"medium"}]}