Live › vulnerability › CVE-2026-109937
Go to dashboardThe Otter Blocks WordPress plugin before 3.2.3 accepts a user-supplied return URL for Stripe Checkout without checking that it belongs to the site. An unauthenticated attacker can send victims through checkout and redirect them to an arbitrary external site afterward.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Otter Blocks WordPress plugin older than 3.2.3 that use its Stripe Checkout flow are exposed, since the return URL comes from the request. Sites on 3.2.3 or later, or without the Stripe feature in use, can skip it.
No product ranges from the sources yet.
wp plugin get otter-blocks --field=version3.2.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.
This page as .md · .json · in your agent: get_signal("CVE-2026-109937")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.