Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Missing Authorization to Form Submission Email Disclosure via Dashboard Widget
- ID
- WPSEC-2026-0033
- Plugin
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (otter-blocks)
- Affected
- from 3.2.0 before 3.2.7
- Remediation
- Update to 3.2.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Otter Blocks on WPSec AttackSurface
- Fix released
- Published
Description
The Otter Blocks plugin for WordPress is vulnerable to unauthorized access of data in versions 3.2.0 up to, and including, 3.2.6 due to a missing capability check on the 'Otter Blocks - Form Submissions' dashboard widget (Dashboard::form_submissions_widget() and form_submissions_widget_content()). The widget is registered on wp_dashboard_setup for every user who can open the wp-admin Dashboard, whereas the Submissions list requires the edit_otter_form_records capability, which only administrators hold. This makes it possible for authenticated attackers with Subscriber-level access and above to view the email addresses entered by site visitors in the five most recent form submissions (filterable to read or unread), their dates and the submission counts. The widget appears once a site has saved Otter form email settings; the free plugin stores submissions from version 3.2.0. Versions 2.4.0 to 3.1.x expose the same data only when Otter Pro is active.
References
- https://wpsec.com/vuln/WPSEC-2026-0033/
- https://plugins.svn.wordpress.org/otter-blocks/tags/3.2.7/
- https://wordpress.org/plugins/otter-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS