{"id":"CVE-2026-109934","published":"2026-10-23T06:17:05.283","lastModified":"2026-10-23T14:20:57.920","description":"The Otter Blocks  WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-200"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/f634bde0-bfb0-4bf9-9c85-fb72763c5dfd/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}