Threats tagged 'drupal-contrib-2026-300'

The AlternativeCommerce PayPal Checkout module for Drupal does not properly validate incoming PayPal webhook requests. This vulnerability allows an unauthenticated attacker to submit a crafted webhook request referencing a payment record, causing the associated order to be marked as paid without actual payment completion. A fix is available in version 1.1.1.