Threats affecting pkg:composer/craftcms/commerce

A vulnerability in Craft Commerce versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4 allows exposure of sensitive order information to unauthenticated users. The PaymentsController::actionPay endpoint discloses serialized order data, including customer email and addresses, when an order number is provided and the email verification fails during an anonymous payment attempt.