Otter Blocks permits Stripe product entitlement substitution
Otter Blocks through 3.1.7 does not bind the user-controlled product_id handled by watch_checkout() to the corresponding price_id in a Stripe checkout URL. An unauthenticated buyer can pay for a lower-cost item while obtaining entitlement to a premium product.
- Component
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Plugin slug
otter-blocks- Affected
- <= 3.1.7
- Safe version
- See mitigation notes
- Published
- Sep 07, 2026
This CVE was published Sep 07, 2026 and is one of 20 known issues for this plugin.
Update, patch or deactivate.
No confirmed fixed release is identified. Obtain a vendor-confirmed patch or disable the affected Stripe checkout block, then review recent purchases for mismatched price and product identifiers.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N