The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the… (CVE-2026-109937)

The Otter Blocks WordPress plugin prior to version 3.2.3 fails to validate that a user-supplied return URL belongs to the same site before incorporating it as the return destination in a Stripe Checkout session. This improper validation can be exploited by unauthenticated attackers to redirect users to arbitrary external URLs after they complete or cancel a checkout process, potentially facilitating phishing or other malicious redirection attacks.

An attacker can cause users to be redirected to arbitrary external URLs after completing or canceling a Stripe Checkout session. This could be used for phishing or redirecting users to malicious sites. There is no indication of direct compromise of the site or user data beyond the redirection. The vulnerability requires user interaction (UI:R) and has no privileges required (PR:N).

A fix is available in Otter Blocks plugin version 3.2.3 or later. Users should upgrade to version 3.2.3 or newer to ensure proper validation of return URLs and prevent open redirect vulnerabilities. No other mitigation guidance is provided or necessary.