CVE-2026-109937: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in Otter Blocks

CVE-2026-109937 describes an open redirect vulnerability (CWE-601) in the Otter Blocks WordPress plugin prior to version 3.2.3. The flaw arises because the plugin fails to verify that the return URL provided by users belongs to the legitimate site before constructing the return destination for Stripe Checkout sessions. Consequently, attackers can craft URLs that redirect victims to malicious external sites upon checkout completion or cancellation without authentication.

An attacker can exploit this vulnerability to redirect users to arbitrary external websites after they complete or cancel a Stripe Checkout session. This can facilitate phishing or other social engineering attacks by misleading users into visiting malicious sites. However, the vulnerability does not directly allow code execution or data compromise within the plugin itself.

Upgrade the Otter Blocks plugin to version 3.2.3 or later, where this vulnerability has been fixed. No other mitigation is required as the fix is available in the official plugin update.