The Otter Blocks WordPress plugin, before version 3.2.3, fails to validate user-supplied return URLs before incorporating them into Stripe Checkout session redirects. This flaw allows attackers to set arbitrary external URLs for victims who finish or cancel checkout, enabling phishing or malicious redirect attacks. The weakness corresponds to an open redirect flaw (CWE‑601) and could expose users to social‑engineering or credential theft attempts.

Otter Blocks WordPress plugin versions prior to 3.2.3. The vulnerability affects any WordPress site that relies on an unsecured Otter Blocks installation.

The CVSS score is 5.4, indicating moderate risk, and the EPSS score is unavailable, making the precise exploitation likelihood uncertain. The vulnerability is not listed in CISA’s KEV inventory, suggesting no known large‑scale exploitation activity. Nonetheless, being an unauthenticated open redirect that can be triggered through the public checkout interface implies a moderate risk; attackers can craft URLs that lure users onto malicious sites after finishing or canceling checkout. Due to the lack of input validation, the attack surface is broad and requires no special user privileges.