CVE-2026-109937 - Vulnerability Details - OpenCVE

The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Wordpress-extensions	Otter Blocks

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/9765313d-c879-457f-851f-dab74b8d90a0/

History

Tue, 20 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wordpress-extensions Wordpress-extensions otter Blocks
Vendors & Products		Wordpress-extensions Wordpress-extensions otter Blocks

Sun, 18 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 18 Oct 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-601

Sun, 18 Oct 2026 06:30:00 +0000

Type	Values Removed	Values Added
Description		The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.
Title		Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
References		https://wpscan.com/vulnerability/9765313d-c879-457f-851f-dab74b8d90a0/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-10-18T06:00:14.838Z

Updated: 2026-10-18T11:12:31.318Z

Reserved: 2026-10-13T11:18:33.392Z

Link: CVE-2026-109937

Vulnrichment

Updated: 2026-10-18T10:58:22.967Z

NVD

Status : Deferred

Published: 2026-10-18T07:16:50.927

Modified: 2026-10-19T21:02:51.987

Link: CVE-2026-109937

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109937", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-10-13T11:18:33.392Z", "datePublished": "2026-10-18T06:00:14.838Z", "dateUpdated": "2026-10-18T11:12:31.318Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-10-18T06:00:14.838Z"}, "title": "Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block", "problemTypes": [{"descriptions": [{"description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Otter Blocks", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "3.2.3"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL."}], "references": [{"url": "https://wpscan.com/vulnerability/9765313d-c879-457f-851f-dab74b8d90a0/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "John Ryan Albon", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-109937", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-18T10:58:37.704515Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-18T11:12:31.318Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-109937", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-18T10:58:37.704515Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-18T10:58:22.967Z"}}], "cna": {"title": "Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "John Ryan Albon"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Otter Blocks", "versions": [{"status": "affected", "version": "0", "lessThan": "3.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/9765313d-c879-457f-851f-dab74b8d90a0/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-10-18T06:00:14.838Z"}}}, "cveMetadata": {"cveId": "CVE-2026-109937", "state": "PUBLISHED", "dateUpdated": "2026-10-18T11:12:31.318Z", "dateReserved": "2026-10-13T11:18:33.392Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-10-18T06:00:14.838Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}