The issue is a CSRF flaw in Drupal Commerce Core that permits attackers to perform actions on behalf of a logged‑in user without the user’s consent. If exploited, an attacker could trigger state‑changing requests such as changing product options, posting orders, or modifying user data. The weakness is identified as CWE‑352, indicating insufficient validation of request origin.

Vulnerability affects Drupal Commerce Core from its earliest release up to version 2.41.0 inclusive, and also from versions 3.0.0 through 3.3.13 inclusive. Any site running Drupal Commerce within these version ranges is potentially exposed.

The EPSS score is not available, and there is no CVSS score disclosed for this vulnerability; without a CVSS score we cannot quantify exact severity, but the fact that the flaw allows state‑changing actions without consent suggests a potentially high impact if exploited. The vulnerability is not listed in CISA’s KEV catalog, so no evidence of widespread exploitation is known. However, CSRF remains a common attack vector on e‑commerce platforms, and the threat surface is limited to users who are authenticated and privileged. Nevertheless, an administrative or customer account compromise could enable significant damage.