Payment Notification Vulnerability in PayPal Affecting E-commerce Systems
CVE-2026-113468

6.9MEDIUM

Key Information:

Vendor

Typo3

Status
Extension "typo3 Shop By Coding.ms"
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113468?

The PayPal payment notification endpoint lacks proper validation, allowing unauthorized users to submit data that can overwrite pending payment notifications. This vulnerability exposes e-commerce sites that utilize PayPal for transactions, as it can lead to incorrect order status updates. Orders that have already been processed and paid are not at risk, but the potential for misuse exists, especially in environments where order plugins are actively utilized. Website administrators should ensure that their integrations adhere to secure data handling practices to mitigate this risk.

Affected Version(s)

Extension "TYPO3 Shop by coding.ms" 6.0.0 < 6.3.0

Extension "TYPO3 Shop by coding.ms" 5.0.0 < 5.21.1

Extension "TYPO3 Shop by coding.ms" 0 < 4.9.4

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-036
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Le Thanh Nam
Thomas Deuling
.