The Otter Blocks plugin for WordPress contains an improper authorization vulnerability (CWE-285) due to reliance on client-side cookie data ('o_stripe_data') for purchase verification. The 'get_customer_data' method uses this unsigned cookie to determine Stripe product ownership, and the 'check_purchase' method trusts this data without server-side verification against the Stripe API for one-time payment purchases. This allows unauthenticated attackers to forge the cookie with a product ID exposed in the checkout block's HTML source, bypassing purchase restrictions and accessing gated content.

An attacker can bypass purchase verification controls and gain unauthorized access to content that should be restricted to paying customers. This leads to confidentiality breaches of paid content. The vulnerability does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or restricting access to sensitive content through alternative means. Monitor the vendor's communications for updates and apply patches promptly once available.