{"id":"CVE-2026-109937","kind":"vulnerability","aliases":["CVE-2026-109937"],"related":[],"title":"Otter Blocks WordPress plugin: open redirect after Stripe checkout","description":"The Otter Blocks  WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.","summary":"The Otter Blocks WordPress plugin before 3.2.3 accepts a user-supplied return URL for Stripe Checkout without checking that it belongs to the site. An unauthenticated attacker can send victims through checkout and redirect them to an arbitrary external site afterward.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","stripe","wordpress","wordpress-plugin"],"not_affected_if":["no-stripe-checkout","version-3.2.3-or-later"],"how_to_check":"- Check the installed Otter Blocks version in the WordPress plugins list or with `wp plugin get otter-blocks --field=version`\n- Confirm whether the Stripe checkout feature of the plugin is in use; the sources do not say which settings enable it","fix":"- Update the Otter Blocks plugin to `3.2.3` or later\n- unknown for any workaround before the update","status":"open","published_at":"2026-10-18T07:16:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:16:54+00:00","updated_at":"2026-10-25T04:16:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:16:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Otter Blocks plugin to `3.2.3` or later\n- unknown for any workaround before the update","reach":"internet","title":"Otter Blocks WordPress plugin: open redirect after Stripe checkout","impact":"low","summary":"The Otter Blocks WordPress plugin before 3.2.3 accepts a user-supplied return URL for Stripe Checkout without checking that it belongs to the site. An unauthenticated attacker can send victims through checkout and redirect them to an arbitrary external site afterward.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","stripe"],"confidence":0.7,"needs_auth":"no","worst_case":"Victims are redirected to an arbitrary external site after checkout","analyst_note":"","how_to_check":"- Check the installed Otter Blocks version in the WordPress plugins list or with `wp plugin get otter-blocks --field=version`\n- Confirm whether the Stripe checkout feature of the plugin is in use; the sources do not say which settings enable it","needs_analyst":false,"not_affected_if":["version-3.2.3-or-later","no-stripe-checkout"],"who_is_affected":"Sites running the Otter Blocks WordPress plugin older than 3.2.3 that use its Stripe Checkout flow are exposed, since the return URL comes from the request. Sites on 3.2.3 or later, or without the Stripe feature in use, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000606,"input_tokens":3328,"output_tokens":547,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109937':12A,15A '-2026':11A,14A '3.2.3':28B,70C 'accept':29B 'afterward':63B 'allow':98C 'arbitrari':60B,111C 'attack':49B,100C 'belong':43B,81C 'block':2A,24B,66C 'build':89C 'cancel':107C 'check':40B 'checkout':9A,38B,54B,96C,108C 'complet':105C 'cve':10A,13A 'destin':92C 'extern':61B,112C 'open':5A 'otter':1A,23B,65C 'packag':16B 'plugin':4A,21B,26B,68C 'redirect':6A,56B,102C 'return':34B,79C,91C 'send':51B 'session':97C 'site':46B,62B,84C 'stripe':8A,17B,37B,95C 'suppli':33B,78C 'unauthent':48B,99C 'url':35B,80C,113C 'use':86C 'user':32B,77C 'user-suppli':31B,76C 'valid':73C 'victim':52B,103C 'without':39B 'wordpress':3A,18B,20B,25B,67C 'wordpress-plugin':19B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Otter Blocks WordPress plugin older than 3.2.3 that use its Stripe Checkout flow are exposed, since the return URL comes from the request. Sites on 3.2.3 or later, or without the Stripe feature in use, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109937","severity":null,"published_at":"2026-10-18T07:16:50+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}