Otter Blocks WordPress Plugin Vulnerable to Purchase Bypass (CVE-2026-2892)

The Otter Blocks plugin for WordPress, in versions up to and including 3.1.4, is susceptible to a purchase verification bypass, identified as CVE-2026-2892. The National Vulnerability Database reports that this flaw stems from the get_customer_data method’s reliance on an unsigned o_stripe_data cookie to verify Stripe product ownership for unauthenticated users. Critically, the check_purchase method trusts this cookie data without server-side validation against the Stripe API for one-time ‘payment’ mode purchases.

This design flaw creates a glaring hole: unauthenticated attackers can forge the o_stripe_data cookie with a target product ID, which is often publicly exposed in the checkout block’s HTML source. By doing so, they can bypass Stripe purchase-gated content visibility conditions, effectively gaining unauthorized access to premium content or features. The National Vulnerability Database assigns this a CVSS score of 7.5 (High), underscoring its significant impact on confidentiality.

For defenders, this is a clear reminder that client-side controls are never sufficient for authorization. Any mechanism relying on unverified client-side data for access decisions is fundamentally broken. The attacker’s calculus here is simple: find a publicly exposed product ID, forge a cookie, and gain access. There’s no complex exploit chain, just a logical bypass.