Otter Blocks EUVD-2026-91247

Requires an authenticated account with subscriber-level privileges or above on the target WordPress site (PR:L), and the site must have the Otter Blocks Form feature in use so that the themeisle_blocks_form_emails option is non-empty - the normal state once any Form block has been saved - which causes the vulnerable widget to be registered. Exploitation is performed via the 'otter_form_widget_filter' parameter. Limiting factors: the attacker must first obtain a valid account (so sites with closed/approval-based registration raise the bar considerably), only a small, fixed set of data is exposed (five most recent submitter emails, their dates, and a total count), and sites that never use the Form block are not affected. No user interaction by a victim is required (UI:N).

This is a low-severity information-disclosure issue (CVSS 3.1 base 3.1) and the real-world risk signals are consistently low rather than conflicting. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable but authenticated flaw with only limited confidentiality impact and no integrity or availability impact. No EPSS score was supplied in the input, and there is no CISA KEV listing and no public proof-of-concept referenced - only a Wordfence threat-intel entry and the WordPress plugin source lines showing the vulnerable code. Exploitation status is therefore 'no public exploit identified at time of analysis.' The authentication requirement (PR:L, subscriber-level) meaningfully limits who can abuse this: an attacker must already hold a registered account on the target site. The practical payoff is also narrow - the email addresses of only the five most recent form submitters, their submission dates, and a total submission count - so this is a privacy/data-leak concern rather than a system-compromise priority. Net: a genuine but low-priority finding; patch in routine maintenance cycles, prioritizing sites that allow open user registration (where subscriber accounts are trivially obtained) and that actively collect form submissions containing sensitive contacts.

An attacker registers (or already holds) a subscriber-level account on a WordPress site running Otter Blocks ≤3.2.6 that uses the plugin's Form block. Using the otter_form_widget_filter parameter, they query the dashboard widget and harvest the email addresses, submission timestamps, and total submission count of the five most recent form submitters. No public exploit code is referenced, and the elevated attack complexity (AC:H) plus required authentication make this opportunistic data skimming rather than mass exploitation.