Plugin Ecommerce
Monthly
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Stripe order confirmation processed more than once, producing duplicate orders and repeated cart, inventory, and transaction side effects in affected Payload CMS deployments. The flaw affects @payloadcms/plugin-ecommerce versions before 3.90.0 and 4.x canary builds before 4.0.0-canary.34, and only installations that configure the Stripe payment adapter are exposed - deployments that do not use the Stripe payment flow are explicitly unaffected. No public exploit code has been identified at time of analysis, and the vendor has shipped patched releases plus guidance requiring order finalization to be idempotent.
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Stripe order confirmation processed more than once, producing duplicate orders and repeated cart, inventory, and transaction side effects in affected Payload CMS deployments. The flaw affects @payloadcms/plugin-ecommerce versions before 3.90.0 and 4.x canary builds before 4.0.0-canary.34, and only installations that configure the Stripe payment adapter are exposed - deployments that do not use the Stripe payment flow are explicitly unaffected. No public exploit code has been identified at time of analysis, and the vendor has shipped patched releases plus guidance requiring order finalization to be idempotent.