Skip to content
CVSS 7.5 · HIGH

CVE-2026-2892

The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership for unauthenticated users. The 'check_purchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'o_stripe_data' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.

Ver en NVD

Análisis

Otter Blocks for WordPress (versions up to 3.1.4) contains a purchase verification bypass. Anyone using the plugin to gate content behind Stripe payments is vulnerable, as attackers can forge a cookie to gain unauthorized access without valid server-side verification. Update to the latest version to secure your gated content.

Severidad

Puntaje: 7.5(HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: NONE
A: NONE
Tipo de falla (CWE): CWE-285

EPSS

Probabilidad de explotación (próx. 30 días): 0.0008 (0.1%)
Percentil: 22.2%
EPSS: 2026-05-06

Descripción técnica

The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership for unauthenticated users. The 'check_purchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'o_stripe_data' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.

Publicada: 30/4/2026, 14:16:29
Última modificación: 30/4/2026, 14:52:54

Referencias

InicioEventosBlogRecursosEquipo