TYPO3 Shop Extension CVE-2026-113468

Requires (1) the coding.ms TYPO3 shop extension installed and a publicly reachable page that renders the shop's order plugin, and (2) a target order in the 'awaiting payment' state - orders already paid are explicitly unaffected, which is the primary limiting factor. The PayPal payment-notification endpoint performs no origin/authorization check, so no authentication, no privileges, and no user interaction are needed (PR:N/UI:N); the realistic constraint is availability of an unpaid order and an exposed order-plugin page rather than any access barrier.

Signals are modest and largely consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which matches the description: 'any site visitor' can act with no privileges or interaction. However, impact is deliberately narrow - only VI:L (low integrity) with VC/VA/SC/SI/SA all N - meaning an attacker can overwrite the stored payment-notification record of a pending order but cannot read data, cause outages, or (per the vector) escalate into order fulfillment or financial loss. CWE-862 (Missing Authorization) correctly frames this as a missing origin/authorization check on the PayPal notification endpoint rather than a true authentication bypass. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis; exploitation is plausible given the trivial preconditions but unproven. Net: this is a legitimately-rated medium (6.9) integrity issue in a niche TYPO3 shop extension - real and easy to trigger, but limited blast radius (data tampering on unpaid orders only), so it is a moderate-priority patch rather than an emergency. Note the data gap: the business consequence of overwriting a notification (e.g., whether it can falsely mark an order paid or inject content viewed by an operator) is not spelled out in the description - verify with the TYPO3 advisory before dismissing it.

An attacker browses to a public shop page that renders the order plugin and locates (or creates) an order still awaiting payment. They then send a forged request directly to the PayPal payment-notification endpoint, which accepts the data without verifying it originated from PayPal, overwriting that order's stored notification with attacker-controlled content. No authentication or user interaction is required, and no public proof-of-concept was provided in the input.