CVE-2026-4945 Overview
CVE-2026-4945 affects the Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress. The vulnerability is an Insecure Direct Object Reference [CWE-639] in the watch_checkout function. It affects all versions up to and including 3.1.7. Unauthenticated attackers can manipulate the product_id parameter independently of the price_id parameter in the Stripe checkout URL. This allows purchasing a lower-cost product while gaining entitlement to a premium product. The flaw stems from missing validation on a user-controlled key during Stripe checkout processing.
Critical Impact
Unauthenticated attackers can pay for a low-cost item and receive premium product entitlements, causing revenue loss for site operators using Stripe checkout blocks.
Affected Products
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress
- All versions up to and including 3.1.7
- Deployments using the Stripe Checkout block feature
Discovery Timeline
- 2026-09-07 - CVE-2026-4945 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-4945
Vulnerability Analysis
The Otter Blocks plugin implements a Stripe checkout feature that renders payment links using both a product_id and a price_id. The watch_checkout function processes returning checkout sessions and grants access based on the product identifier supplied via the URL. Because the plugin does not validate that the product_id matches the price_id actually paid, an attacker can decouple these values. The attacker completes a legitimate Stripe payment for a low-priced item but supplies the identifier of a premium product back to the WordPress site. The plugin then issues the entitlement for the more expensive product. This is a business logic flaw rooted in trusting client-controlled parameters to determine post-payment authorization.
Root Cause
The root cause is missing server-side validation in the watch_checkout function within class-stripe-api.php. The plugin accepts a user-controlled product_id key without cross-referencing it against the actual Stripe session or the associated price_id. The vulnerable logic is visible in the plugin source at class-stripe-api.php line 234 and line 304, and the render path at class-stripe-checkout-block.php line 69.
Attack Vector
The attack requires no authentication and no user interaction on the target site. An attacker constructs a Stripe checkout URL where the price_id corresponds to an inexpensive product and the product_id corresponds to a premium product. After completing the low-cost payment, the plugin honors the manipulated product_id and grants premium entitlement. The attack is fully remote and executed over the network.
No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Intelligence Report for additional technical context.
Detection Methods for CVE-2026-4945
Indicators of Compromise
- Stripe checkout completions where the recorded price_id amount does not match the entitlement granted for the associated product_id.
- Unusually low-value Stripe transactions immediately followed by access to premium content or downloads.
- Repeated checkout requests from the same IP address with varying product_id values but identical price_id values.
Detection Strategies
- Reconcile Stripe transaction logs against WordPress user entitlements to identify mismatches between paid price and granted product.
- Inspect web server access logs for requests to the Otter Blocks checkout endpoint containing mismatched product_id and price_id parameters.
- Audit the Otter Blocks plugin version across managed WordPress sites and flag installations at or below version 3.1.7.
Monitoring Recommendations
- Enable webhook logging in the Stripe dashboard and correlate checkout.session.completed events with WordPress entitlement grants.
- Alert on newly granted premium entitlements that do not correspond to a matching high-value Stripe charge.
- Monitor WordPress plugin update feeds for Otter Blocks releases beyond 3.1.7 and confirm patched versions are deployed.
How to Mitigate CVE-2026-4945
Immediate Actions Required
- Update Otter Blocks to the version released after changeset 3496611, which addresses the watch_checkout validation gap.
- Audit recent Stripe transactions for evidence of product_id and price_id mismatches and revoke fraudulently granted entitlements.
- If patching is not immediately possible, disable the Stripe Checkout block feature within Otter Blocks.
Patch Information
The vendor addressed the issue in the WordPress plugin changeset #3496611. The fix adds validation so that the product_id parameter can no longer be manipulated independently of the price_id in the checkout flow. Site administrators should upgrade Otter Blocks to any version higher than 3.1.7.
Workarounds
- Temporarily remove or disable Stripe Checkout blocks from published pages until the plugin is upgraded.
- Restrict access to the Stripe checkout endpoint using a web application firewall rule that rejects requests with inconsistent product_id and price_id pairs.
- Manually reconcile every Stripe payment against entitlements until the patch is applied.
# Configuration example: verify installed Otter Blocks version via WP-CLI
wp plugin get otter-blocks --field=version
# Upgrade Otter Blocks to the latest patched release
wp plugin update otter-blocks
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.