SA-CONTRIB-2026-302: Critical severity composer/drupal/commerce_escrow vulnerability
Published Nov 4, 2026
·Updated
This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress.
Credit
Marcus Johansson (marcus_johansson)
Affected Software
1 affected componentFixes available
composer/drupal/commerce_escrow<1.1.0
1.1.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/commerce_escrowto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Nov 4, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software