CVE-2026-109934 Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-109934?
CVE-2026-109934 is a medium-severity vulnerability in Unknown Otter Blocks, published on 23 Oct 2026.
Official description
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
Weakness: CWE-200
Which versions are affected by CVE-2026-109934?
How do I fix CVE-2026-109934?
No fix has been published for CVE-2026-109934 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-109934 being exploited?
There is no known exploitation of CVE-2026-109934 in the wild and no public exploit code.
Sources
Also known as GHSA-v2v8-j877-jpr5.