This vulnerability in the Otter Blocks plugin enables an unauthenticated attacker to bypass purchase verification for gated WordPress content. The flaw stems from the get_customer_data method relying on an unsigned 'o_stripe_data' cookie to assess Stripe product ownership, and the subsequent check_purchase method trusting this cookie without server‑side validation against the Stripe API for one‑time payment mode purchases. By forging the cookie with a target product ID, which is exposed in the checkout block’s HTML, an attacker can trigger the condition to expose premium content without having actually purchased it.

The issue affects the ThemeIsle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress, versions up to and including 3.1.4. Users running these plugin versions on any WordPress installation are vulnerable until the issue is remediated.

The CVSS score of 7.5 indicates a high severity risk for the affected sites. The EPSS score is not available, and this vulnerability has not been listed in the CISA KEV catalog. Attackers can exploit this flaw remotely by crafting a forged 'o_stripe_data' cookie and injecting it into the user’s browser; because the cookie value is not verified server‑side, the request is accepted, granting unauthorized access to purchase‑restricted content. Given that the attacker only needs to manipulate a browser cookie and the product ID is publicly visible, the likelihood of exploitation is considered high in the context of a publicly accessible WordPress site.