Is CVE-2026-4945 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-4945?

CVE-2026-4945 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-4945

Description

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.