CVE-2026-109937: Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block

Q: Who is exposed to this issue?

Sites using a version of the Themeisle Otter Blocks WordPress plugin earlier than 3.2.3 are affected when the Stripe Checkout Block is used. The redirect can affect victims after they complete or cancel a Stripe Checkout session.

Q: Does exploitation require an authenticated WordPress account?

No. The issue is described as unauthenticated, so an attacker does not need a WordPress account to supply the unvalidated return URL.

Q: What should be checked when assessing exposure?

Check the installed Otter Blocks version and whether the site uses the Stripe Checkout Block. Versions before 3.2.3 do not validate that the supplied checkout return URL belongs to the site.

Published Oct 18, 2026

Updated

The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.

Affected Software

1 affected component

Themeisle Otter Blocks<3.2.3

Event History

Oct 18, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

Who is exposed to this issue?

Sites using a version of the Themeisle Otter Blocks WordPress plugin earlier than 3.2.3 are affected when the Stripe Checkout Block is used. The redirect can affect victims after they complete or cancel a Stripe Checkout session.

Does exploitation require an authenticated WordPress account?

No. The issue is described as unauthenticated, so an attacker does not need a WordPress account to supply the unvalidated return URL.

What should be checked when assessing exposure?

Check the installed Otter Blocks version and whether the site uses the Stripe Checkout Block. Versions before 3.2.3 do not validate that the supplied checkout return URL belongs to the site.

CVE-2026-109937: Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require an authenticated WordPress account?

What should be checked when assessing exposure?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require an authenticated WordPress account?

What should be checked when assessing exposure?