CVE-2026-118558
Low risk· EPSS 1%Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Drupal Commerce Stripe module is vulnerable to Cross-Site Request Forgery (CSRF), which can force unwanted actions on behalf of a logged-in user. This issue affects versions from 2.0.0 to 2.2.3.
Risk Assessment
An attacker could trick an administrator or user into performing unauthorized operations, potentially altering payment configuration or causing unwanted transactions. This requires user interaction but can have serious business consequences.
Recommendation
Update the Commerce Stripe module to a version later than 2.2.3. Additionally, consider implementing CSRF protections such as tokens and security headers.
Other vulnerabilities in Drupal Commerce Stripe
See all- CVE-2026-118560Low risk· EPSS 5%
The Commerce Stripe module for Drupal contains a Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 2.0.0 to 2.2.3.
- CVE-2026-118559Low risk· EPSS 1%
The Drupal Commerce Stripe module contains an improper verification of cryptographic signature vulnerability, allowing signature spoofing. This issue affects versions from 0.0.0 to 1.4 and from 2.0.0 to 2.2.3.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS