Otter Blocks EUVD-2026-108587

No authentication, user interaction, or special configuration is required for the core flaw: a remote unauthenticated attacker can query the plugin's REST API endpoint against default installations of Otter Blocks before 3.2.8 and receive data it should withhold, because the code treats any 'published'-status post as publicly readable without verifying actual readability. The exposure is limited in scope to manual excerpts of password-protected posts and the titles/content of non-public post types. The additional disclosure of coupon codes and their descriptions is CONDITIONAL on the site also running WooCommerce. Limiting factors: only data already stored in these specific forms is exposed (not full post bodies of password-protected posts beyond the manual excerpt, and no write/modify capability), and the site must be running an affected 3.1.1-3.2.7 version of the plugin.

This is a moderate, confidentiality-only information-disclosure issue rather than a top-priority emergency, and the available signals agree on that. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, C:L/I:N/A:N) reflects an easy, remote, unauthenticated reach but only a limited confidentiality impact and no integrity or availability effect. The SSVC decision framework reinforces the modest picture: Exploitation 'none' (no observed activity), Automatable 'no', and Technical Impact 'partial', which aligns with the vuln.today 'this_month' priority label - act within the normal patch cycle, not immediately. There is no CISA KEV listing and no confirmed public exploit code, so this is not confirmed active exploitation. EPSS is NOT provided in the input, so exploitation probability cannot be quantified here - this is a genuine data gap. The CVSS 'C:L' rating matches the description: what leaks is bounded (manual excerpts of password-protected posts, titles/content of non-public post types, and - only on WooCommerce sites - coupon codes and descriptions), not full credential or database compromise. Net: a real but low-urgency flaw whose chief value to an attacker is reconnaissance or scraping of unpublished/discount data.

An unauthenticated attacker sends crafted requests to the plugin's REST API endpoint on a WordPress site running Otter Blocks before 3.2.8, which incorrectly treats any post with 'published' status as public. The response leaks manual excerpts of password-protected posts, the titles and content of non-public post types, and on WooCommerce sites the coupon codes and their descriptions. No public exploit identified at time of analysis, but exploitation is scriptable given the low complexity and lack of authentication.