Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.2.10 - Authenticated (Author+) Denial of Service via Recursive Synced Patterns
- ID
- WPSEC-2026-3136
- Plugin
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (otter-blocks)
- Affected
- all versions before 3.2.11
- Remediation
- Update to 3.2.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-674
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-14
- Attack surface
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE on WPSec AttackSurface
- Fix released
- Published
Description
The Otter Blocks plugin for WordPress is vulnerable to Denial of Service via synced patterns (reusable blocks) in all versions up to, and including, 3.2.10, due to uncontrolled recursion when the plugin collects custom CSS, stylesheets and Google Fonts for synced patterns that reference themselves or each other. This makes it possible for authenticated attackers, with author-level access and above, to publish a self-referencing synced pattern and embed it in a published post, causing front-end requests for pages that display that post, such as the post itself or the blog index, to exhaust resources and fail.
References
- https://wpsec.com/vuln/WPSEC-2026-3136/
- https://plugins.svn.wordpress.org/otter-blocks/tags/3.2.11/
- https://wordpress.org/plugins/otter-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS