An endpoint used for PayPal payment notifications does not verify that incoming data originates from the payment provider. Consequently, any visitor can send a request that overwrites the stored notification for an order that has not yet been marked as paid, allowing arbitrary content to be injected. The change does not affect orders that are already confirmed as paid but can corrupt the payment status for pending orders, potentially leading to incorrect order processing or financial loss.

TYPO3 sites that use the TYPO3 Shop by coding.ms extension. No specific version numbers are listed, so the issue applies to all published releases of that extension.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is less than 1%, suggesting low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to the PayPal notification endpoint; an attacker does not require special privileges or credentials to exploit the flaw.