PT-2026-36099 · Themeisle · The Otter Blocks – Gutenberg Blocks

Drew Webber · Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-2892

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get customer data' method relying on an unsigned 'o stripe data' cookie to determine Stripe product ownership for unauthenticated users. The 'check purchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'o stripe data' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-2892

Affected Products

The Otter Blocks – Gutenberg Blocks

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2892 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3443950f-1f94-4e0b-8906-1a9b9602a746?source=cve · Note
• https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L260 · Note
• https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-block-conditions.php#L274 · Note
• https://plugins.trac.wordpress.org/changeset/3471326 · Note
• https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L284 · Note