PT-2026-121760
CVE-2026-109934
·
Published
2026-10-23
·
Updated
2026-10-23
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾