CVE-2026-113468
Received Received - Intake

PayPal Payment Notification Manipulation Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TYPO3

Description
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113468
EUVD
EUVD-2026-104865

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
TYPO3 Extension "TYPO3 Shop by coding.ms" 6.0.0
TYPO3 Extension "TYPO3 Shop by coding.ms" 5.0.0
TYPO3 Extension "TYPO3 Shop by coding.ms" 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows any visitor to a website to manipulate payment notifications for orders that have not yet been paid. The payment notification endpoint does not verify if the data comes from the actual payment provider, enabling unauthorized changes to stored payment details.

Impact Analysis

If you run a website using the affected TYPO3 Shop extension, attackers could alter payment notifications to show incorrect payment statuses. This could lead to unpaid orders being marked as paid, causing financial losses or disputes.

Mitigation Strategies

Disable the payment notification endpoint in the TYPO3 Shop extension until a patch is applied. Review order data for unauthorized modifications and ensure only verified payment providers can update payment status.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113468. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart