Otter Blocks kept a visitor’s Stripe purchase history in an unsigned ‘o_stripe_data’ browser cookie and trusted it when evaluating the ‘Stripe purchase’ block-visibility condition. An unauthenticated visitor could forge that cookie with a product ID read straight out of the public checkout-block markup and unlock paid, purchase-gated content without paying. Otter Blocks 3.1.5 signs the cookie with an HMAC-SHA256 keyed on the site’s wp_salt() and verifies it with hash_equals() before the data is used.
This vulnerability affects the following application versions:
- Otter Blocks 2.2.0
- Otter Blocks 2.2.1
- Otter Blocks 2.2.2
- Otter Blocks 2.2.3
- Otter Blocks 2.2.4
- Otter Blocks 2.2.5
- Otter Blocks 2.2.6
- Otter Blocks 2.2.7
- Otter Blocks 2.3.0
- Otter Blocks 2.3.1
- Otter Blocks 2.3.2
- Otter Blocks 2.3.3
- Otter Blocks 2.3.4
- Otter Blocks 2.4.0
- Otter Blocks 2.4.1
- Otter Blocks 2.5.0
- Otter Blocks 2.5.1
- Otter Blocks 2.5.2
- Otter Blocks 2.6.0
- Otter Blocks 2.6.1
- Otter Blocks 2.6.2
- Otter Blocks 2.6.3
- Otter Blocks 2.6.4
- Otter Blocks 2.6.5
- Otter Blocks 2.6.6
- Otter Blocks 2.6.7
- Otter Blocks 2.6.8
- Otter Blocks 2.6.9
- Otter Blocks 2.6.10
- Otter Blocks 2.6.11
- Otter Blocks 2.6.12
- Otter Blocks 2.6.13
- Otter Blocks 3.0.0
- Otter Blocks 3.0.1
- Otter Blocks 3.0.2
- Otter Blocks 3.0.3
- Otter Blocks 3.0.4
- Otter Blocks 3.0.5
- Otter Blocks 3.0.6
- Otter Blocks 3.0.7
- Otter Blocks 3.0.8
- Otter Blocks 3.0.9
- Otter Blocks 3.0.10
- Otter Blocks 3.0.11
- Otter Blocks 3.0.12
- Otter Blocks 3.1.0
- Otter Blocks 3.1.1
- Otter Blocks 3.1.2
- Otter Blocks 3.1.3
- Otter Blocks 3.1.4