{"id":"CVE-2026-4945","aliases":["EUVD-2026-72366","GHSA-pvh2-45c7-fq5c"],"status":"published","title":"Otter Blocks \u003c= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass","description":"The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00391,"percentile":0.33681,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-09-07T12:29:05Z","modified":"2026-09-08T14:17:23Z","products":[{"vendor":"themeisle","product":"otter blocks – gutenberg blocks, page builder for gutenberg editor \u0026 fse"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ecb9f61-68d5-4c70-8d7d-e4fb067fcff9?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/render/class-stripe-checkout-block.php#L69"},{"url":"https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L234"},{"url":"https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L304"},{"url":"https://plugins.trac.wordpress.org/changeset/3496611/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4945"},{"url":"https://plugins.trac.wordpress.org/changeset/3496611"},{"url":"https://github.com/advisories/GHSA-pvh2-45c7-fq5c"}],"sources":{"cve":[{"id":"CVE-2026-4945","title":"Otter Blocks \u003c= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass","description":"The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.","status":"published","published":"2026-09-07T12:29:05.051Z","modified":"2026-09-08T13:57:39.203Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-72366","description":"The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.","status":"published","published":"2026-09-07T12:29:05Z","modified":"2026-09-08T13:57:39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:29.426Z"}],"ghsa":[{"id":"GHSA-pvh2-45c7-fq5c","title":"The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE plugin for WordPress...","description":"The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.","status":"published","published":"2026-09-07T15:33:51Z","modified":"2026-09-07T15:33:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:11:26.557204Z"}],"nvd":[{"id":"CVE-2026-4945","description":"The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.","status":"published","published":"2026-09-07T13:20:22.07Z","modified":"2026-09-08T14:17:23.673Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:44.082631Z"}]}}