CVE-2026-109934

MediumCVSS 5.3/10Last modified Oct 23, 2026

Description

The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Unknown	Otter Blocks	>= 3.1.1, < 3.2.8

References

https://wpscan.com/vulnerability/f634bde0-bfb0-4bf9-9c85-fb72763c5dfd/

Timeline

Published: Oct 23, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1099355.3The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through t CVE-2026-1099367.5The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rende CVE-2026-1099375.4The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to bui CVE-2026-1099386.5Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client af CVE-2026-1099396.5FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which a CVE-2026-109946.5Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information fro CVE-2026-1099404.3FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt CVE-2026-1099416.5FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang cli CVE-2026-1099426.5FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_cont CVE-2026-1099436.5FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned Polygo CVE-2026-1099446.5FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate CVE-2026-1099455.9FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_