{
 "id": "WPSEC-2026-3136",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3136/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3136/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3136/index.md",
 "title": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.2.10 - Authenticated (Author+) Denial of Service via Recursive Synced Patterns",
 "description": "The Otter Blocks plugin for WordPress is vulnerable to Denial of Service via synced patterns (reusable blocks) in all versions up to, and including, 3.2.10, due to uncontrolled recursion when the plugin collects custom CSS, stylesheets and Google Fonts for synced patterns that reference themselves or each other. This makes it possible for authenticated attackers, with author-level access and above, to publish a self-referencing synced pattern and embed it in a published post, causing front-end requests for pages that display that post, such as the post itself or the blog index, to exhaust resources and fail.",
 "plugin": {
  "slug": "otter-blocks",
  "name": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE",
  "full_name": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE",
  "wordpress_org": "https://wordpress.org/plugins/otter-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/otter-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/otter-blocks"
 },
 "type": "DOS",
 "cwe": [
  "CWE-674"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.2.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.2.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.2.11",
 "remediation": "Update to 3.2.11 or later.",
 "fix_released": "2026-11-13T09:26:16+00:00",
 "published": "2026-11-14T09:40:51+00:00",
 "updated": "2026-11-13T15:53:37.392424+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3136/",
  "https://plugins.svn.wordpress.org/otter-blocks/tags/3.2.11/",
  "https://wordpress.org/plugins/otter-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/otter-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-14"
 }
}