Otter Blocks WordPress Plugin Purchase Verification Bypass Vulnerability

A vulnerability exists in the Otter Blocks plugin for WordPress, affecting all versions up to and including 3.1.4. The issue arises from the 'get_customer_data' method, which depends on an unsigned 'o_stripe_data' cookie to verify Stripe product ownership for unauthenticated users. The 'check_purchase' method accepts this cookie information without conducting server-side validation against the Stripe API for one-time 'payment' mode transactions. As a result, unauthenticated attackers can manipulate the 'o_stripe_data' cookie to bypass content restrictions tied to Stripe purchases, using product IDs that are publicly available in the checkout block's HTML.

Impact

Exploitation of this vulnerability allows unauthenticated users to bypass purchase verification checks, potentially leading to unauthorized access to content or features that require a valid Stripe purchase.

Remediation

Users are advised to update the Otter Blocks plugin to version 3.1.5 or a later patched version.