CVE-2026-4945
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Otter Blocks plugin for WordPress, in all versions up to and including 3.1.7, is vulnerable to Insecure Direct Object Reference in the 'watch_checkout' function due to missing validation on a user controlled key. This allows unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
Risk Assessment
Risk of financial loss and unauthorized access to premium features in online stores using this plugin.
Recommendation
It is recommended to immediately update the Otter Blocks plugin to a version newer than 3.1.7 if available, and implement additional server-side validation for payment parameters.
Other vulnerabilities in Otter Blocks
See all- CVE-2026-109933Medium
The Otter Blocks WordPress plugin before version 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet. This allows users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
- CVE-2026-102002Low
The Otter Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.2.6 via the 'otter_form_widget_filter' parameter. This allows authenticated attackers with subscriber-level access and above to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count.
Original NVD description (English source)
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS