Vulnerability DRUPAL-CONTRIB-2026-300
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 hours ago
November 04, 2026 at 05:33 PM UTC
No summary available
<1.1.1
<1.1.1
Details
The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal.
The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causing the associated order to be marked as paid without completing a payment.
References
Impacted packages
Timeline
Published
4 hours ago
November 04, 2026 at 05:33 PM UTC
Last Modified
1 hour ago
November 04, 2026 at 08:30 PM UTC