DRUPAL-CONTRIB-2026-300: Composer/drupal/basket_paypal vulnerability
The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal.
The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causing the associated order to be marked as paid without completing a payment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/basket_paypalto a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the AlternativeCommerce PayPal Checkout module are exposed if they accept its PayPal webhook requests. An unauthenticated attacker can target payment records through crafted webhook requests.
What does an attacker need to do to exploit it?
The attacker must submit a crafted PayPal webhook request that references a payment record. No authentication is required, and successful exploitation can cause the associated order to be marked as paid without a completed payment.
How can I tell whether exploitation may have occurred?
Review orders marked as paid and compare them with completed PayPal payments. Investigate paid orders whose corresponding payment was not completed, particularly where the payment state may have been changed by incoming webhook processing.