Otter Blocks Gutenberg Blocks Page Builder For Gutenberg Editor Fse
Monthly
Insecure Direct Object Reference in Otter Blocks (WordPress plugin by Themeisle) through version 3.1.7 enables unauthenticated attackers to decouple the `product_id` and `price_id` parameters in a Stripe checkout URL, paying the price of a cheaper product while the `watch_checkout` function grants entitlement for the premium product whose ID was substituted. The flaw is exploitable against any WordPress site running the plugin with a Stripe checkout block configured. No public exploit has been identified at time of analysis, and a patch commit (changeset 3496611) has been applied to the plugin repository.
Insecure Direct Object Reference in Otter Blocks (WordPress plugin by Themeisle) through version 3.1.7 enables unauthenticated attackers to decouple the `product_id` and `price_id` parameters in a Stripe checkout URL, paying the price of a cheaper product while the `watch_checkout` function grants entitlement for the premium product whose ID was substituted. The flaw is exploitable against any WordPress site running the plugin with a Stripe checkout block configured. No public exploit has been identified at time of analysis, and a patch commit (changeset 3496611) has been applied to the plugin repository.