CVE-2026-4945: Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the productid parameter independently of the priceid parameter in the Stripe checkout URL.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker needs to manipulate the product_id parameter independently from the price_id parameter in a Stripe checkout URL. No authentication or user interaction is required.
What is the practical impact on a vulnerable site?
An attacker may pay the price associated with a lower-cost product while receiving entitlement to a premium product. The supplied severity vector indicates integrity impact only, with no stated confidentiality or availability impact.
Which installations are affected?
All versions of the Otter Blocks plugin up to and including 3.1.7 are affected. The issue applies to the plugin's Stripe checkout handling through the watch_checkout function.