CVE-2026-2892Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership for unauthenticated users. The 'check_purchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'o_stripe_data' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-285

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://sec.kaitan.id/cves/CVE-2026-2892

Full discourse1 post

Kaitan ID Security@KaitanSecurity161d
Disclosure
⚠️ HIGH — CVE-2026-2892 The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and includin… CVSS 7.5 Full analysis → https://sec.kaitan.id/cves/CVE-2026-2892 #WordPress #CyberSecurity #InfoSec
Post summary
A high‑severity vulnerability (CVE‑2026‑2892) was disclosed in the Otter Blocks WordPress plugin, allowing purchase verification bypass, with a CVSS score of 7.5 and detailed analysis available online.
0000022
256 followersView on X

Explore more

Back to dashboard