Commerce Elavon
Monthly
Information disclosure in the Drupal Commerce Elavon payment-gateway module stems from improper input validation (CWE-20) and, per the NVD scoring, is reachable by remote unauthenticated attackers. The Drupal security advisory (SA-CONTRIB-2026-084) leaves the affected range wholly unspecified ('*.*'), so every published version should be treated as potentially vulnerable until a fixed release is identified. No public exploit identified at time of analysis, and the EPSS score sits in the 4th percentile, indicating little observed exploitation interest despite the headline 9.8 rating.
Information disclosure in the Drupal Commerce Elavon payment-gateway module stems from improper input validation (CWE-20) and, per the NVD scoring, is reachable by remote unauthenticated attackers. The Drupal security advisory (SA-CONTRIB-2026-084) leaves the affected range wholly unspecified ('*.*'), so every published version should be treated as potentially vulnerable until a fixed release is identified. No public exploit identified at time of analysis, and the EPSS score sits in the 4th percentile, indicating little observed exploitation interest despite the headline 9.8 rating.