Otter Blocks CVE-2026-109937

Exploitation requires that the target site runs Otter Blocks before 3.2.3 and uses its Stripe Checkout feature, since the flaw is in how a user-supplied return URL is used to build the Stripe Checkout session's return destination without validating it belongs to the site. The decisive limiting factor is user interaction (UI:R): a victim must actually begin and then complete or cancel a checkout session for the redirect to fire, so the attacker cannot trigger it unassisted and must socially engineer the victim into the payment flow. No authentication is required of the attacker (PR:N), but the practical blast radius is limited to victims the attacker can lure into checkout on the vulnerable site, and impact is confined to redirection (no code execution or direct data compromise on the server).

This is a moderate-severity open redirect (CWE-601) whose signals are mutually consistent and point to a low-to-moderate real-world priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, 5.4 Medium) indicates a network-reachable, low-complexity flaw an unauthenticated attacker can trigger, but it explicitly requires user interaction (UI:R) - the victim must initiate and complete or cancel a Stripe Checkout session - which caps impact and prevents fully automated mass exploitation. SSVC reinforces the low-urgency read: Exploitation 'none' (no observed active exploitation), Automatable 'no', and Technical Impact 'partial'. No EPSS score and no CISA KEV listing were provided; absence of KEV is consistent with the SSVC 'no active exploitation' signal. Public exploit code exists (WPScan), so weaponization against unpatched sites is feasible, but a POC is a distinct signal from active exploitation and should not be read as in-the-wild use. Net: a credible phishing/credential-harvesting enabler worth patching on a normal cadence, not a drop-everything issue. The main value of this flaw to an attacker is lending legitimacy to phishing by abusing a trusted site domain in the redirect chain.

An attacker crafts a Stripe Checkout link on a site running a vulnerable Otter Blocks install with a return URL pointing to an attacker-controlled domain, then lures a victim (e.g., via email) to begin checkout on the trusted site. When the victim completes or cancels the payment flow, the plugin redirects them to the attacker's external URL - which can host a convincing phishing or credential-harvesting page that appears to originate from the legitimate merchant. Publicly available exploit detail from WPScan makes reproduction straightforward against unpatched sites.