CVE-2026-2892: 
WordPress vulnerability analysis and mitigation

CVE-2026-2892 is a Purchase Verification Bypass vulnerability in the Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress, affecting all versions up to and including 3.1.4. The flaw allows unauthenticated attackers to bypass Stripe purchase-gated content by forging an unsigned client-side cookie. It was published on April 30, 2026, with a patch released the same day. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Wordfence).

The root cause is Improper Authorization (CWE-285): the plugin's get_customer_data method reads an unsigned o_stripe_data cookie to determine Stripe product ownership for unauthenticated users, and the check_purchase method trusts this cookie value without performing any server-side verification against the Stripe API for one-time 'payment' mode purchases. Because the target product ID is publicly exposed in the checkout block's HTML source, an attacker can trivially extract it and craft a forged cookie. No authentication or special privileges are required, and exploitation requires no user interaction (GitHub Advisory, Wordfence, Otter Blocks Source).

Successful exploitation allows unauthenticated attackers to access content that site owners have restricted to paying customers via Stripe purchase gates, resulting in a high confidentiality impact. Affected sites may suffer unauthorized disclosure of premium or paywalled content (e.g., digital downloads, exclusive articles, or member-only resources). Integrity and availability are not directly impacted by this vulnerability (GitHub Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.057–0.081%, placing it in the lower percentiles for near-term exploitation likelihood (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the Otter Blocks plugin (versions ≤ 3.1.4) using passive techniques such as HTTP response headers, plugin enumeration, or public search engines.
2. Extract product ID: Visit a page containing a Stripe-gated checkout block and inspect the HTML source to locate the publicly exposed Stripe product ID embedded in the block's markup.
3. Forge the cookie: Craft a forged o_stripe_data cookie containing the extracted product ID in the format expected by the get_customer_data method (e.g., a JSON structure with the product ID set as a purchased item).
4. Send the request: Submit an HTTP request to the target page with the forged o_stripe_data cookie set in the browser or via a tool such as curl or Burp Suite.
5. Access gated content: The check_purchase method trusts the cookie without server-side Stripe API verification, causing the plugin to render the purchase-gated content as if the attacker had legitimately purchased the product (GitHub Advisory, Otter Blocks Source).

• Network: HTTP requests to Stripe-gated content pages from unauthenticated sessions (no valid session cookie or logged-in user) that successfully return protected content; repeated access attempts to purchase-gated URLs without corresponding Stripe payment events.
• Logs: WordPress access logs showing requests to pages with Stripe checkout blocks from unauthenticated users (no wordpress_logged_in_* cookie) that receive HTTP 200 responses for normally restricted content.
• Cookies: Presence of a manually crafted o_stripe_data cookie in request headers that does not correspond to any legitimate Stripe session or payment record; cookie values containing product IDs not associated with completed transactions in the Stripe dashboard.

Site administrators should update the Otter Blocks plugin to a version newer than 3.1.4 immediately, as a patch was released on April 30, 2026 (changeset 3471326) (Otter Blocks Patch). As a workaround prior to patching, consider disabling Stripe purchase-gated content blocks or restricting access to gated pages via server-level authentication. The fix should implement server-side verification of purchase status against the Stripe API and replace the unsigned cookie with a cryptographically signed token (Wordfence).

Wordfence, which assigned and disclosed the CVE, included it in their weekly WordPress vulnerability report for the period of April 27–May 3, 2026 (Wordfence Blog). The vulnerability received brief social media mentions on Mastodon and Bluesky shortly after disclosure, consistent with routine CVE publication activity rather than significant community alarm. No major media coverage or notable researcher commentary beyond the initial disclosure has been identified.