CVE-2026-4945: 
WordPress vulnerability analysis and mitigation

CVE-2026-4945 is an Insecure Direct Object Reference (IDOR) vulnerability in the Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress, affecting all versions up to and including 3.1.7. The flaw exists in the watch_checkout function, which fails to validate a user-controlled key, allowing unauthenticated attackers to manipulate the product_id parameter independently of the price_id parameter in the Stripe checkout URL. This enables attackers to pay for a lower-cost product while obtaining entitlement for a premium product. Disclosed on September 7, 2026, it carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The root cause is missing server-side validation in the watch_checkout function within class-stripe-checkout-block.php (line 69), which processes Stripe checkout parameters without verifying that the product_id and price_id parameters correspond to the same product offering. An unauthenticated attacker can craft a Stripe checkout URL with a low-cost price_id paired with a premium product_id, and the plugin will grant entitlement to the premium product upon payment of the lower price. Relevant source code is publicly accessible in the WordPress plugin repository at class-stripe-api.php (lines 234 and 304) (GitHub Advisory, WordPress Trac).

Successful exploitation allows unauthenticated attackers to commit payment fraud by obtaining premium product entitlements while only paying for lower-cost items, resulting in direct financial loss for site owners and merchants using the Otter Blocks Stripe checkout integration. The integrity impact is low and scoped to the affected component, with no confidentiality or availability impact. There is no evidence of lateral movement potential or sensitive data exposure beyond the fraudulent entitlement grant (GitHub Advisory, Wordfence).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is automatable (no user interaction or privileges required), making it accessible to any network-based attacker. The EPSS score is approximately 0.298% (22nd percentile), indicating a low near-term exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities catalog, and no threat actor attribution has been reported (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Otter Blocks plugin version 3.1.7 or earlier that have Stripe checkout functionality enabled (e.g., via Wappalyzer, WPScan, or manual inspection of page source for Otter Blocks indicators).
2. Identify checkout parameters: Navigate to a product checkout page and capture the Stripe checkout URL, noting the product_id and price_id parameters present in the request or URL.
3. Enumerate premium product IDs: Identify the product_id of a premium/higher-value product (e.g., by browsing other product pages or inspecting page source for exposed product identifiers).
4. Craft malicious checkout URL: Modify the Stripe checkout URL to substitute the premium product's product_id while retaining the price_id of a lower-cost product, exploiting the missing validation in the watch_checkout function.
5. Complete payment: Submit the manipulated checkout, paying only the lower price. The plugin grants entitlement to the premium product due to the lack of server-side correlation between product_id and price_id (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing checkout requests where product_id and price_id parameters do not correspond to the same product offering; repeated checkout attempts with varying product_id values paired with the same low-cost price_id.
• Application: Stripe payment records showing low-value transactions followed by premium product entitlement grants; mismatches between purchased price tier and granted product access in order/entitlement logs.
• Network: Unusual patterns of Stripe checkout URL requests with parameter manipulation from the same IP or user session.

Update the Otter Blocks plugin to a version newer than 3.1.7, which includes the fix introduced in changeset 3496611 on the WordPress plugin repository. As a workaround prior to patching, site administrators can temporarily disable the Stripe checkout block functionality if it is not critical. Longer-term, the vendor recommends implementing server-side validation to verify that product_id and price_id parameters correspond to the same product before processing any payment (WordPress Trac Changeset, Wordfence).