Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.1

Otter Blocks can leak recent form submitters' emails

CVE-2026-102002 · published 17 days ago
Summary

The Otter Blocks plugin for WordPress allows users with a subscriber account or higher to see the email addresses, submission dates, and total count of the five most recent form entries through a dashboard widget. This information is exposed whenever the form feature is used, potentially revealing private data about your customers. Update the plugin to a version newer than 3.2.6 or disable the form widget until the update is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
themeisle otter blocks – gutenberg blocks, page builder for gutenberg editor & fse <= 3.2.6
Original advisory text
Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter_form_widget_filter' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty — the normal state after any Form block has been saved — meaning the exposure is active on any standard site using the plugin's form feature.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-102002 · NVD
CVE-2026-102002 · MITRE
Track software like this
Free during beta