CVE-2026-4945
Received Received - Intake

Insecure Direct Object Reference in Otter Blocks WordPress Plugin

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: Wordfence

Description
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-4945
EUVD
EUVD-2026-72366

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
otter_blocks otter_blocks to 3.1.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Otter Blocks WordPress plugin. It allows unauthenticated attackers to manipulate the product_id parameter in a Stripe checkout URL to pay for a lower-cost product while gaining access to a premium product. The issue occurs due to missing validation in the 'watch_checkout' function up to version 3.1.7.

Detection Guidance

This vulnerability is specific to the Otter Blocks WordPress plugin. To detect it, check if your WordPress site has the Otter Blocks plugin installed and verify its version. If the version is 3.1.7 or lower, the site is vulnerable. Use commands like 'wp plugin list' in WP-CLI or check the plugin list in the WordPress admin dashboard.

Impact Analysis

If you use the Otter Blocks plugin on your WordPress site, attackers could exploit this to purchase a cheaper product but receive a premium product's access or features. This could lead to financial loss, unauthorized access to premium content, or abuse of your site's offerings.

Compliance Impact

This vulnerability may impact compliance with GDPR or HIPAA if it leads to unauthorized access to sensitive data or premium content. GDPR requires protecting personal data, and HIPAA mandates securing health information. Exploitation could result in breaches, violating these regulations and potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Immediately update the Otter Blocks plugin to the latest version if available. If no update is available, consider disabling or removing the plugin until a patch is released. Additionally, review Stripe checkout URLs for suspicious product_id and price_id parameter manipulations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4945. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart