# Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.2.10 - Authenticated (Author+) Denial of Service via Recursive Synced Patterns

- **ID:** WPSEC-2026-3136
- **Plugin:** Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (`otter-blocks`), https://wordpress.org/plugins/otter-blocks/
- **Affected versions:** all versions before 3.2.11
- **Fixed in:** 3.2.11 (Update to 3.2.11 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
- **Weakness:** CWE-674
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/otter-blocks
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3136/

## Description

The Otter Blocks plugin for WordPress is vulnerable to Denial of Service via synced patterns (reusable blocks) in all versions up to, and including, 3.2.10, due to uncontrolled recursion when the plugin collects custom CSS, stylesheets and Google Fonts for synced patterns that reference themselves or each other. This makes it possible for authenticated attackers, with author-level access and above, to publish a self-referencing synced pattern and embed it in a published post, causing front-end requests for pages that display that post, such as the post itself or the blog index, to exhaust resources and fail.

## References

- https://wpsec.com/vuln/WPSEC-2026-3136/
- https://plugins.svn.wordpress.org/otter-blocks/tags/3.2.11/
- https://wordpress.org/plugins/otter-blocks/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3136/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.