Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment (CVE-2026-48016) | HOL Guard CVE