EUVD-2026-93493
GHSA-8r29-2mp2-pmrw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Confirmation endpoint is network-reachable and a simple retry suffices (AV:N/AC:L/PR:N/UI:N); impact is integrity of orders/payments (I:H) with minor inventory-state availability effect (A:L) and no data disclosure (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
AnalysisAI
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Stripe order confirmation processed more than once, producing duplicate orders and repeated cart, inventory, and transaction side effects in affected Payload CMS deployments. The flaw affects @payloadcms/plugin-ecommerce versions before 3.90.0 and 4.x canary builds before 4.0.0-canary.34, and only installations that configure the Stripe payment adapter are exposed - deployments that do not use the Stripe payment flow are explicitly unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable ONLY when the deployment uses @payloadcms/plugin-ecommerce together with the Stripe payment adapter; the advisory explicitly states deployments not using the Stripe payment flow are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N, base 8.8) describes a network-reachable, low-complexity flaw with no confidentiality impact but high integrity and availability impact - consistent with CWE-837 (improper enforcement of a single unique action) and the advisory's description of a Stripe order confirmation being processed more than once. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches: upgrade @payloadcms/plugin-ecommerce and the corresponding Payload packages to 3.90.0 or later, or to 4.0.0-canary.34 or later on the canary line, per the advisory at https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Payload CMS deployments for the @payloadcms/plugin-ecommerce package and confirm which ones configure the Stripe payment adapter; treat only those as in scope, and expand webhook and order-log monitoring on them to detect repeated confirmations for the same Stripe event or order identifier so duplicate order creation, inventory decrement, and transaction records are caught and reversed quickly. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbit
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker sub
Malformed multipart request bodies sent to Payload CMS versions 3.0.0 through 3.89.x and 4.0.0-canary.0 through 4.0.0-ca
Authenticated users who can update an auth collection document in Payload CMS can change the password field on that docu
Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the
Payload CMS prior to 3.73.0 has a SQL injection vulnerability when querying structured data, enabling database compromis
Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote
Payload CMS (npm package `payload`) versions 3.0.0 through 3.89.x and 4.0.0-canary builds before canary.34 hash account
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access t
Authentication claim injection in Payload CMS affects versions after 3.0.0 and before 3.90.0, where a collection field c
Stored Cross-Site Scripting (XSS) in Payload CMS versions prior to 3.78.0 allows authenticated users with write permissi
Share
External POC / Exploit Code
Leaving vuln.today