DRUPAL-CONTRIB-2026-302: Composer/drupal/commerce_escrow vulnerability
This module enables you to accept payments through Escrow.com with Drupal Commerce.
The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/commerce_escrowto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Drupal Commerce sites using the composer/drupal/commerce_escrow module and accepting Escrow.com webhook notifications are exposed. The issue affects the handling of incoming Escrow.com payment and order-status notifications.
What would an attacker need to exploit it?
An attacker would need to send forged Escrow.com webhook notifications to the affected module. The provided information does not indicate that access to a legitimate Escrow.com account or payment is required.
What is the likely impact of a successful exploit?
Forged notifications can cause unpaid orders to be marked as paid or completed. They can also cancel orders that are already in progress.