The Otter Blocks plugin for WordPress contains an authorization flaw that allows unauthenticated attackers to bypass purchase verification and access protected content.

The vulnerability exists because the plugin relies on an unsigned cookie to determine Stripe product ownership. Unauthenticated attackers can manipulate the o_stripe_data cookie to falsely claim purchase verification, as the server fails to validate this data against the official Stripe API.

A successful exploit allows unauthorized users to bypass paywalls or access restricted content intended only for paying customers. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to revenue streams and the integrity of premium offerings on affected WordPress sites.

Immediate Action: Update the Otter Blocks plugin to the latest version, ensuring it is at least 3.1.5 or newer, to incorporate the necessary server-side verification logic.

Proactive Monitoring: Monitor site access logs for unusual patterns of traffic directed at protected content or unexpected attempts to interact with the Stripe-related cookie parameters.

Compensating Controls: Implement a Web Application Firewall rule to block or sanitize requests containing suspicious or malformed o_stripe_data cookie strings.

Public Exploit Available: No — there is no confirmed public exploit available.

This vulnerability represents a significant authorization failure that directly impacts content protection mechanisms. Administrators should treat this as a high-priority update to prevent unauthorized content access. Ensure that all instances of the Otter Blocks plugin are updated immediately to the patched version to eliminate the risk of cookie-based purchase bypass.