Payload Ecommerce plugin: Duplicate processing of Stripe order confirmations
Summary
The Stripe payment adapter of the Payload e-commerce plugin can process one Stripe order confirmation more than once under certain conditions. This can lead to duplicate orders and inconsistent inventory or payment records, which affects data integrity. According to the CVSS vector, no privileges or user interaction are required, and deployments that do not use the Stripe payment flow are not affected.
Affected
- @payloadcms/plugin-ecommerce versions before 3.90.0
- @payloadcms/plugin-ecommerce versions from 4.0.0-canary.0 before 4.0.0-canary.34
- Payload core packages (payloadcms/payload) in the same version ranges, as listed in the official CVE record
Fixed in
- 3.90.0
- 4.0.0-canary.34
Workaround
- Ensure that Stripe order confirmations can only be processed once. The vendor describes this as a temporary mitigation only.
- No further workaround is documented by the vendor.
Exploitation
- No known exploitation in the wild.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
- No public proof of concept was found in our searches.
Our recommendation
- Check lockfiles and deployed versions of @payloadcms/plugin-ecommerce and the core payload package.
- Upgrade to 3.90.0 or 4.0.0-canary.34 or later, matching your release line.
- Review recent Stripe orders for duplicates and reconcile them with Stripe.
- Monitor the order confirmation endpoint for repeated confirmations until the upgrade is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8r29-2mp2-pmrw (Payload) github.com
- Payload release v3.90.0 github.com
- Fix commit 6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e github.com
- GitHub Advisory Database GHSA-8r29-2mp2-pmrw github.com
- OSV CVE-2026-105850 osv.dev
- GitLab Advisory CVE-2026-105850 (npm plugin-ecommerce) advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:15.
Original description (NVD)
Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.