---
id: "CVE-2026-109937"
kind: "vulnerability"
aliases: ["CVE-2026-109937"]
title: "Otter Blocks WordPress plugin: open redirect after Stripe checkout"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "stripe", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-stripe-checkout", "version-3.2.3-or-later"]
published_at: "2026-10-18T07:16:50+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:16:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109937", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Otter Blocks WordPress plugin: open redirect after Stripe checkout

The Otter Blocks WordPress plugin before 3.2.3 accepts a user-supplied return URL for Stripe Checkout without checking that it belongs to the site. An unauthenticated attacker can send victims through checkout and redirect them to an arbitrary external site afterward.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Otter Blocks version in the WordPress plugins list or with `wp plugin get otter-blocks --field=version`
- Confirm whether the Stripe checkout feature of the plugin is in use; the sources do not say which settings enable it

## Fix

- Update the Otter Blocks plugin to `3.2.3` or later
- unknown for any workaround before the update

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109937

## From the sources

The Otter Blocks  WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_