Cpe:2.3:a:payload_cms:payloadcms_plugin_ecommerce:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apayload_cmspayloadcms_plugin_ecommerce/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 06 Oct 2026 18:47:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDuplicate Order Processing in Payload Ecommerce Stripe Adapterhttps://feed.craftedsignal.io/briefs/2026-10-payload-ecommerce-race/Tue, 06 Oct 2026 18:47:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-payload-ecommerce-race/A logic flaw in the @payloadcms/plugin-ecommerce Stripe payment adapter allows order confirmations to be processed multiple times, posing a risk of duplicate fulfillment.Payload CMS has disclosed a vulnerability in the @payloadcms/plugin-ecommerce package that impacts the handling of Stripe payment adapter events. Under specific conditions, an order confirmation can be processed more than once, potentially leading to duplicate transaction processing or redundant order fulfillment. This issue affects versions prior to 3.90.0 and certain 4.0.0-canary releases. This flaw is identified as CVE-2026-105850 and relates to the atomicity or idempotency of the confirmation processing logic within the plugin.

Impact

Successful exploitation of this logic flaw can result in financial discrepancies, unauthorized duplicate orders, and inventory or fulfillment errors for affected e-commerce deployments. The scope is limited to systems utilizing the @payloadcms/plugin-ecommerce with Stripe integration.

Recommendation

Prioritize the upgrade of the @payloadcms/plugin-ecommerce package to version 3.90.0 or higher, or 4.0.0-canary.34 or higher, to resolve CVE-2026-105850. In environments where immediate patching is not feasible, implement idempotency checks at the application or database layer to ensure Stripe webhooks related to order confirmation are only processed once per unique transaction identifier.

]]>highadvisory