What is the CVSS score of CVE-2026-2892?

CVE-2026-2892 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Otter Blocks are affected by CVE-2026-2892?

Otter Blocks for WordPress versions 3.1.4 and earlier contain a critical payment bypass vulnerability allowing unauthenticated attackers to forge authentication cookies and access premium content…

How to fix or mitigate CVE-2026-2892?

Within 24 hours: Identify all WordPress installations running Otter Blocks ≤3.1.4 and disable the Stripe payment gate functionality or restrict access to the affected checkout blocks pending patching. Within 7 days: Contact Otter Blocks vendor for patch availability and timeline; if unavailable, implement WAF rules to block manipulation of 'o_stripe_data' cookies or migrate to alternative payment plugin verified to validate transactions server-side. Within 30 days: Apply vendor-released patch to all instances once available, verify Stripe API validation is enforced for all payment transactions, and conduct audit of premium content access logs for unauthorized access dating back 90 days.

Otter Blocks CVE-2026-2892

EUVD-2026-26373 HIGH

Improper Authorization (CWE-285)

2026-04-30 security@wordfence.com

WordPress Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 14:30 vuln.today

EUVD ID Assigned

Apr 30, 2026 - 14:22 euvd

EUVD-2026-26373

Analysis Generated

Apr 30, 2026 - 14:22 vuln.today

CVE Published

Apr 30, 2026 - 14:16 nvd

HIGH 7.5

DescriptionCVE.org

The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership for unauthenticated users. The 'check_purchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'o_stripe_data' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.

AnalysisAI

Unauthenticated attackers can bypass Stripe payment gates in Otter Blocks for WordPress ≤3.1.4 by forging the 'o_stripe_data' cookie with publicly visible product IDs from checkout block HTML source, gaining unauthorized access to premium content. The plugin's 'get_customer_data' method accepts unsigned cookie data without server-side Stripe API verification for one-time purchases, enabling trivial exploitation with no authentication required. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) reflects high confidentiality impact from accessing gated content. EPSS data unavailable; no active exploitation or POC confirmed at time of analysis, but the attack requires only basic HTTP cookie manipulation skills.

Technical ContextAI

Otter Blocks is a WordPress plugin providing block-based content management with Stripe integration for payment-gated content. The vulnerability stems from CWE-285 (Improper Authorization) where the 'check_purchase' method in class-block-conditions.php calls 'get_customer_data' from class-stripe-api.php, which reads the client-controlled 'o_stripe_data' cookie without cryptographic signature validation. For one-time 'payment' mode purchases, the plugin bypasses server-side Stripe API verification and trusts the cookie's product ID claim directly. The product IDs themselves are embedded in the checkout block's rendered HTML, making them trivially discoverable via browser developer tools or page source inspection. This architectural flaw violates secure design principles by treating client-supplied data as authoritative for access control decisions without server-side validation against the authoritative payment processor API.

RemediationAI

Upgrade to Otter Blocks version 3.1.5 or later, which addresses the vulnerability per WordPress plugin repository changeset 3471326. The patch implements server-side Stripe API verification for purchase validation rather than trusting unsigned cookie data. Site administrators should update via WordPress admin dashboard (Plugins > Updates) or manually download from the official WordPress plugin repository. After patching, regenerate or invalidate existing 'o_stripe_data' cookies to prevent replay attacks using pre-patch cookie values. If immediate patching is not feasible, implement compensating controls: (1) temporarily disable Stripe payment-gated content blocks until upgrade is possible, though this breaks monetization functionality; (2) implement web application firewall rules to detect suspicious 'o_stripe_data' cookie patterns (e.g., cookies appearing without corresponding Stripe checkout sessions), but this is detection-only and won't prevent exploitation; (3) conduct manual content audit to identify which pages use Stripe gates and consider temporarily restricting access via WordPress role-based permissions, though this prevents legitimate unauthenticated purchasers from accessing content. All workarounds have significant functional trade-offs; vendor patch is the only complete remediation. Consult Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3443950f-1f94-4e0b-8906-1a9b9602a746 for additional guidance.