CVE-2026-109937 Details
Description
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.
A vulnerability exists in the Otter Blocks WordPress plugin in versions prior to 3.2.3. The issue arises because the plugin does not properly validate user-supplied return URLs before using them to direct users after a Stripe Checkout session. This flaw allows unauthenticated attackers to redirect users who complete or cancel their checkout to any external URL of their choice.
Users are advised to update the Otter Blocks WordPress plugin to version 3.2.3 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/9765313d-c879-457f-851f-dab74b8d90a0/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Otter Blocks | < 3.2.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |