CVE-2026-102002
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Otter Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.2.6 via the 'otter_form_widget_filter' parameter. This allows authenticated attackers with subscriber-level access and above to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count.
Risk Assessment
Exposure of email addresses and submitter data can violate user privacy, lead to phishing campaigns, and breach data protection regulations.
Recommendation
Update the Otter Blocks plugin to the latest patched version. Additionally, restrict access to forms and regularly monitor access logs.
Other vulnerabilities in Otter Blocks
See all- CVE-2026-109933Medium
The Otter Blocks WordPress plugin before version 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet. This allows users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
- CVE-2026-4945Medium
The Otter Blocks plugin for WordPress, in all versions up to and including 3.1.7, is vulnerable to Insecure Direct Object Reference in the 'watch_checkout' function due to missing validation on a user controlled key. This allows unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
Original NVD description (English source)
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter_form_widget_filter' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty — the normal state after any Form block has been saved — meaning the exposure is active on any standard site using the plugin's form feature.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS