Improper Enforcement of Behavioral Workflow in magento-lts - #VU158629
Published: November 2, 2026
Vulnerability details
The vulnerability allows a remote privileged user to place full-price orders without payment being collected, attempted, or authorized.
The vulnerability exists due to improper enforcement of the payment workflow in Mage_Payment_Model_Method_Free when order submission reuses a stored payment method without revalidating the cart total. A remote privileged user can use the SOAP/XML-RPC cart API to select the free payment method while the cart total is zero, increase the total by removing a 100%-off coupon or adding items, and submit the order without re-importing payment data to place a non-zero order without payment.
Stock storefront onepage checkout is not affected in practice because order submission fails before placement when payment data is omitted.