CVE-2026-109935
NONE—CVSS v3
—CVSS v2
—
EPSS (exploit probability)
—CWE
Description
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
Affected routers (0)
No routers currently mapped to this CVE in our database.