CVE-2026-105850GHSA-8r29-2mp2-pmrw

@payloadcms/plugin-ecommerce: Payload Ecommerce has an order confirmation validation issue

payloadcms @payloadcms/plugin-ecommercenpmLibraries & packages

CVSS

8.8High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.90.0Also 4.0.0-canary.34GitHub

Published6 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

3.90.0@payloadcms/plugin-ecommerce, npmGitHubnpm install @payloadcms/plugin-ecommerce@3.90.0
4.0.0-canary.34@payloadcms/plugin-ecommerce, npmGitHubnpm install @payloadcms/plugin-ecommerce@4.0.0-canary.34

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Impact

When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions.

You are affected if:

Deployments that do not use the Stripe payment flow are not affected.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Ensure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.

@payloadcms/plugin-ecommerce, npm< 3.90.0GitHub
@payloadcms/plugin-ecommerce, npm>= 4.0.0-canary.0, < 4.0.0-canary.34GitHub
payloadaffected: < 3.90.0CVE List
payloadaffected: >= 4.0.0-canary.0, < 4.0.0-canary.34CVE List
plugin-ecommerceaffected: < 3.90.0CVE List
plugin-ecommerceaffected: >= 4.0.0-canary.0, < 4.0.0-canary.34CVE List
@payloadcms/plugin-ecommerce, npmfrom first release, fixed in 3.90.0OSV
@payloadcms/plugin-ecommerce, npmfrom 4.0.0-canary.0, fixed in 4.0.0-canary.34OSV