Executive brief
Otter Blocks is a WordPress plugin that enables site builders to create pages and content using Gutenberg blocks. The plugin's Stripe payment integration contains a flaw that allows unauthenticated attackers to manipulate checkout parameters, enabling them to purchase lower-cost products while gaining access to premium product entitlements. This could result in revenue loss and unauthorized access to premium features.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the 'watch_checkout' function within the Stripe API handler. The flaw stems from insufficient validation on user-controlled parameters in the Stripe checkout URL, specifically allowing independent manipulation of the product_id and price_id parameters. An unauthenticated attacker can craft a malicious checkout URL that associates a lower-cost product's payment with a premium product's entitlement, bypassing price validation. The vulnerability affects all versions up to and including 3.1.7, and patches are expected to be available in subsequent releases.
Affected products
- WordPress.org Otter Blocks up to 3.1.7
Timeline
- 2026-09-07: disclosed