CVE-2012-5542: Cross-site request forgery (CSRF) vulnerability in the Commerce Extra Panes module 7.x-1.x before 7.x-1.1 i...

Security readout for executives and security teams

This issue affects a Drupal Commerce add-on, Commerce Extra Panes. If an administrator is logged in, an attacker could trick them into making unwanted pane enable or disable changes. The bundle identifies a fixed release, 7.x-1.1, but provides no CVSS score or evidence of active exploitation. Exposure is limited to Drupal sites using Commerce Extra Panes 7.x-1.x before 7.x-1.1. Risk is highest where administrators remain logged in while browsing untrusted content or links. The provided affected metadata is incomplete, listing vendor and product as n/a. Treat this as a moderate priority for legacy Drupal Commerce environments. It is not described as remotely taking over a server, but it can alter commerce checkout behavior through administrator CSRF. Patch during normal vulnerability remediation unless exposed legacy systems are business-critical. Mitigation focus: Upgrade Commerce Extra Panes to 7.x-1.1 or later.; Review the Drupal advisory for project-specific upgrade guidance.; Identify any Drupal 7 sites still using Commerce Extra Panes 7.x-1.x..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.