https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T08:35:19.813748+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-308208 EUVD-2026-308208 2026-10-06T08:35:19.861426+00:00 EUVD-2026-308208 https://cve.radiocsirt.org/vuln/fkie_cve-2026-2892 fkie_cve-2026-2892 2026-10-06T08:35:19.861463+00:00

The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership for unauthenticated users. The 'check_purchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'o_stripe_data' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.

 https://cve.radiocsirt.org/vuln/ghsa-h3rm-xcqx-mv7q GHSA-h3rm-xcqx-mv7q 2026-10-06T08:35:19.861500+00:00

The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership for unauthenticated users. The 'check_purchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'o_stripe_data' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.