Description

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T13:20:22.070Z",
  "pubdate": "2026-09-07T13:20:22.070Z",
  "executiveSummary": "The Otter Blocks WordPress plugin, in versions up to and including 3.1.7, contains an Insecure Direct Object Reference (IDOR) vulnerability within the 'watch_checkout' function. This flaw allows unauthenticated remote attackers to manipulate the Stripe checkout process by decoupling the 'product_id' parameter from the 'price_id' parameter. By successfully exploiting this vulnerability, an attacker can purchase a premium, high-value product at the price point of a lower-cost item. The vulnerability represents a significant financial and authorization flaw, as the system fails to perform server-side validation to ensure that the requested product aligns with the provided pricing configuration. This results in unauthorized entitlement acquisition. Because the vulnerability does not require authentication or specific user privileges, it is accessible to any remote actor capable of interacting with the plugin's checkout endpoint, posing a direct threat to the integrity of the vendor's payment processing and digital goods distribution.",
  "technicalDetails": "The vulnerability resides in the 'watch_checkout' function of the Otter Blocks plugin. The root cause is a lack of server-side validation regarding the relationship between the 'product_id' and 'price_id' parameters submitted via the checkout request. In a secure implementation, the payment gateway integration should rely on a server-managed session or a signed payload that binds the price to the product ID, preventing client-side modification.\nIn the vulnerable versions (up to 3.1.7), the plugin processes the checkout URL parameters directly as supplied by the client. An attacker can intercept the network request sent to the checkout endpoint and modify the 'product_id' parameter to point to a high-value premium item, while leaving the 'price_id' parameter set to correspond with a significantly cheaper product. Because the backend code fails to cross-reference or validate the authenticity of the price-product association against the database, the Stripe API is instructed to initialize a session for the premium product at the lower price point.\nThe attack flow follows these steps: First, the attacker identifies the endpoints associated with the plugin's Stripe integration. Second, the attacker initiates a legitimate checkout process for a low-cost item to capture the request structure. Third, the attacker manipulates the 'product_id' parameter within the request, swapping the identifier for that of a premium, more expensive product. Finally, the attacker submits the modified request to the 'watch_checkout' handler. The backend, lacking validation, generates a payment session for the premium product but applies the pricing logic of the original, lower-cost item. Upon completion of the payment, the plugin marks the premium product as purchased/entitled in the user's account or system logs. The impact of this exploit is a direct bypass of pricing controls, enabling unauthorized access to premium features or content without appropriate financial compensation to the vendor. This vulnerability exposes the application to significant financial loss and undermines the security of the payment processing logic within the WordPress environment."
}