---
id: CVE-2026-109935
title: >-
  Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via
  REST API
summary: >-
  The Otter Blocks  WordPress plugin before 3.2.8 does not enforce its block
  visibility conditions when a published post is rendered through the WordPress
  REST API, allowing unauthenticated users to read block content that the site
  owner r…
severity: none
cwe:
  - CWE-200
product: Otter Blocks
affected:
  - otter_blocks < 3.2.8
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T06:00:17.935Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109935'
references:
  - url: 'https://wpscan.com/vulnerability/f19dbe9c-f172-4eb8-8bfc-d21660aaa739/'
tags:
  - cve.org
ingestedAt: '2026-10-23T06:17:25.174Z'
---

## Overview

The Otter Blocks  WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.

## Affected

- `otter_blocks < 3.2.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.