CVE-2026-4945

Name of the Vulnerable Software and Affected Versions Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE versions prior to 3.1.8

Description An Insecure Direct Object Reference (IDOR) exists in the watch checkout() function due to missing validation on a user-controlled key. This allows unauthenticated attackers to obtain entitlement for a premium product while paying for a lower-cost one by manipulating the product id parameter independently of the price id parameter within the Stripe checkout URL.

Recommendations Update the plugin to version 3.1.8 or later.