Commerce Realex / Global Payments CVE-2026-13238

The target site must be running the Drupal Commerce Realex / Global Payments module in versions 0.0.0 through 3.0.2 (exclusive). The CVSS AC:H metric indicates that exploitation is not trivially automatable - the attacker likely needs to know or enumerate the specific protected URL paths exposed by the module, which may vary by site configuration. No authentication is required (PR:N), meaning the flaw is reachable by any network-accessible party. Exploitation is limited by the requirement to identify the exact vulnerable endpoints, the non-default knowledge of module-specific URL structures, and the restricted scope of impact (low confidentiality and integrity, no availability). Sites that deploy the module behind authentication-gated storefronts or with strict URL access controls at the web server level reduce but do not eliminate exposure.

Multiple signals converge on a moderate-to-low real-world priority. The CVSS 3.1 score is 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N; the AC:H designation indicates exploitation is not straightforward and likely requires specific conditions such as knowledge of target URLs or a particular module configuration. EPSS is 0.18% at the 8th percentile, meaning fewer than 1 in 10 tracked CVEs have lower exploitation probability - a weak signal for opportunistic mass exploitation. SSVC confirms Exploitation: none, Automatable: no, Technical Impact: partial, which further de-prioritizes emergency response. The vulnerability is not listed in CISA KEV. The combination of PR:N (no credentials required) and network exposure is the primary concern, as it lowers the bar for any attacker who can identify the target endpoints. The impact is bounded - C:L and I:L with no availability impact - though in a payment context even limited data exposure or integrity modification carries business and compliance risk beyond raw CVSS. No conflicting signals between data sources; all sources consistently indicate limited exploitation pressure.

An attacker targeting a Drupal e-commerce site identifies that it uses the Commerce Realex / Global Payments module, then enumerates or constructs the URL paths for protected payment confirmation or order-status endpoints. Without holding a user session or any credentials, the attacker directly browses to those paths, triggering the missing authorization check and gaining access to order details or potentially influencing transaction state. No public proof-of-concept code is known at time of analysis, and the AC:H rating suggests knowledge of specific endpoint paths or module configuration is a prerequisite.