CVE-2026-2892: Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie
The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'getcustomerdata' method relying on an unsigned 'ostripedata' cookie to determine Stripe product ownership for unauthenticated users. The 'checkpurchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'ostripedata' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2892?
CVE-2026-2892 is rated as a high severity vulnerability due to improper authorization allowing unauthenticated purchase verification bypass.
How do I fix CVE-2026-2892?
To fix CVE-2026-2892, upgrade the Otter Blocks plugin to version 3.1.5 or later.
What software is affected by CVE-2026-2892?
CVE-2026-2892 affects all versions of the Otter Blocks plugin for WordPress up to and including 3.1.4.
What can attackers do with CVE-2026-2892?
Attackers can exploit CVE-2026-2892 to bypass purchase verification and gain unauthorized access to certain features.
When was CVE-2026-2892 disclosed?
CVE-2026-2892 was disclosed in 2026 but the exact date is not specified in the provided information.