Craft Commerce EUVD-2026-22073

Exploitation requires two concrete prerequisites: (1) the attacker must know or have obtained a valid order number for a completed order in the target Craft Commerce store - order numbers are not publicly listed but may be leaked via forwarded confirmation emails, social engineering, or in stores using predictable number sequences; (2) the Commerce store must have the anonymous (guest) payment flow enabled, which is the default for most storefronts. Exploitation is limited by the CVSS 4.0 AT:P metric (attack prerequisites present). Authentication is not required (PR:N), and no user interaction is needed. Exploitation does not affect payment card data, session tokens, or admin credentials. The impact is bounded to order-level PII (customer email, shipping/billing addresses) for the specific order whose number was supplied.

All available signals converge on low real-world risk. The CVSS 4.0 score of 1.7 with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N reflects network-reachability but notes attack prerequisites (AT:P): an attacker must possess or discover a valid order number, which is non-trivial since order numbers are not public. EPSS is 0.05% (14th percentile), indicating exploitation is statistically unlikely relative to the broader vulnerability landscape. SSVC categorizes exploitation as 'none,' automatable as 'no' (reinforcing the prerequisite barrier), and technical impact as 'partial.' The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept has been identified. The confidentiality impact, while real (PII such as name, email, and postal address), does not include payment card data, credentials, or session tokens. For organizations where data-protection regulations (GDPR, CCPA) apply, even low-severity PII leaks carry compliance weight beyond the CVSS score alone - that is the primary risk signal to consider.

An attacker who has obtained a valid Craft Commerce order number - for instance, through a prior order of their own, a phishing email forwarded from a victim, or enumeration if order numbers are sequential - submits a POST request to the anonymous payment endpoint with the correct order number but a mismatched email address. The failed authorization causes the controller to return a JSON error response that includes the full serialized order object, revealing the customer's email address, shipping address, and billing address without any authentication. No public proof-of-concept exists, but the attack requires no technical sophistication once an order number is known.