Description
The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership for unauthenticated users. The 'check_purchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'o_stripe_data' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.
INFO
Published Date :
2026-04-30T13:28:21.322Z
Last Modified :
2026-05-01T16:38:40.570Z
Source :
Wordfence
AFFECTED PRODUCTS
The following products are affected by CVE-2026-2892 vulnerability.
| Vendors | Products |
|---|---|
| Themeisle |
|
| Wordpress |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-2892.
