CVE-2026-4945 is an insecure direct object reference vulnerability (CWE-639) in the Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE WordPress plugin. The issue arises from missing validation on a user-controlled key in the 'watch_checkout' function, allowing attackers to manipulate the product_id parameter in the Stripe checkout URL. This manipulation enables unauthorized purchase escalation, where attackers pay for a lower-cost product but receive entitlement for a premium product. The vulnerability affects all versions up to and including 3.1.7. No official patch or remediation level has been published yet.

An unauthenticated attacker can exploit this vulnerability to bypass authorization controls during the checkout process, resulting in financial loss due to unauthorized entitlement to premium products while paying only for lower-cost items. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No temporary or official fixes have been documented at this time.