CVE-2026-4945: CWE-639 Authorization Bypass Through User-Controlled Key in themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE

CVE-2026-4945 is an insecure direct object reference vulnerability (CWE-639) in the Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE WordPress plugin. The vulnerability exists in all versions up to and including 3.1.7 within the 'watch_checkout' function, where missing validation on a user-controlled key allows unauthorized manipulation of the product_id parameter independently from the price_id parameter in the Stripe checkout URL. This enables attackers to bypass authorization controls and obtain premium product entitlements by paying for lower-cost products.

An unauthenticated attacker can exploit this vulnerability to bypass authorization controls, resulting in the ability to obtain premium product entitlements while only paying for lower-cost products. This leads to unauthorized access to premium features or content without proper payment, causing potential financial loss to the vendor. The vulnerability does not impact confidentiality or availability but impacts integrity by allowing unauthorized privilege escalation in product entitlement.

No patch or official fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor vendor communications for updates and consider restricting access or disabling the affected functionality if feasible.