CVE-2026-109934: Otter Blocks 3.1.1 to before 3.2.8

Affected technology

Otter Blocks · 3.1.1 to before 3.2.8
Vendor not specified by the source

Description’s affected range: before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint

Component: Not specified by the source

What an attacker can do

Unauthenticated users can read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.