Vulnerability in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE — CVE-2026-4945

What to do now

Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to 3.1.8 or later.

Affected versions

• Everything up to and including 3.1.7

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.

This description is reproduced verbatim from the public vulnerability record.

• https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L234
• https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L304
• https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/render/class-stripe-checkout-block.php#L69
• https://plugins.trac.wordpress.org/changeset/3496611/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7ecb9f61-68d5-4c70-8d7d-e4fb067fcff9?source=cve

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.