SA-CONTRIB-2026-277: Critical severity composer/drupal/commerce_payumoney vulnerability
Published Oct 28, 2026
·Updated
The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.
Credit
Drew Webber (mcdruid)(the Drupal Security Team)
Affected Software
1 affected component
composer/drupal/commerce_payumoney
Event History
Oct 28, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What should site owners do if they use this project?
Treat the project as unsupported because a known security issue has not been fixed by its maintainer. Plan to replace it, remove it, or take over maintenance and address the issue.
2
Is a fix available from the project maintainer?
No fix is identified in the advisory; it states that the known security issue has not been fixed by the maintainer.