This vulnerability allows an attacker to force an authenticated user to submit a state‑changing request to the Drupal Commerce Stripe module without the user’s knowledge. The action can create, cancel, or modify payments, potentially exposing sensitive financial information or modifying order status. It is identified as CWE‑352 and exploits the trust placed in a user’s authenticated session.

The defect exists in the Drupal Commerce Stripe module for versions 2.0.0 through 2.2.3. Sites that have any of those releases deployed are potentially impacted; no other Drupal modules or external products are reported to be affected by this issue.

Because CSRF relies on a victim’s authenticated session, an attacker can target users who are logged into the site and simply supply a crafted link or form. The absence of a CVSS score and an unavailable EPSS score indicates limited publicly known exploitation, but the potential for unauthorized financial transactions or invoice manipulation elevates the threat. The vulnerability is not listed in the CISA KEV catalog, yet it should still be treated as high risk due to its destructive capacity if exploited.