CVE-2026-2892

The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership for unauthenticated users. The 'check_purchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'o_stripe_data' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.

• CWE-285

• https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-block-conditions.php#L274
• https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L260
• https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L284
• https://plugins.trac.wordpress.org/changeset/3471326/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3443950f-1f94-4e0b-8906-1a9b9602a746?source=cve

Published

Apr 30, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28913The issue was addressed with improved memory handling. This …7.5
• CVE-2026-28914A logic issue was addressed with improved file handling. Thi…5.5
• CVE-2026-28915A parsing issue in the handling of directory paths was addre…7.8
• CVE-2026-28917The issue was addressed with improved input validation. This…4.3
• CVE-2026-28918An out-of-bounds access issue was addressed with improved bo…6.5
• CVE-2026-28919A consistency issue was addressed with improved state handli…7.8
• CVE-2026-28920An information leakage was addressed with additional validat…6.5
• CVE-2026-28922This issue was addressed through improved state management. …6.5
• CVE-2026-28923A logging issue was addressed with improved data redaction. …8.8
• CVE-2026-28924A race condition was addressed with improved handling of sym…7.5
• CVE-2026-28925A buffer overflow was addressed with improved bounds checkin…7.5
• CVE-2026-28926A race condition was addressed with improved state handling.…7