Fixed negative number being set on order payment amount

Author: lukeholder

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 - Fixed a bug where GraphQL queries using `relatedTo*` arguments within `hasProduct` or `hasVariant` inputs caused a server error. ([#4297](https://github.com/craftcms/commerce/issues/4297))
 - Cart requests that include a`couponCode` param are now rate-limited. (GHSA-h5gm-x9wr-vhcm)
+- Fixed a bug where a negative payment amount could be set on an order. (GHSA-78vr-q6cf-c7p6)
 
 ## 5.6.4 - 2026-05-06
 

src/elements/Order.php

@@ -2657,6 +2657,7 @@ public function getPaymentAmount(): float
 
     /**
      * Sets the order's payment amount in the order's currency. This amount is not persisted.
+     * This will remain null if set to zero or a negative number.
      *
      * @throws CurrencyException
      * @throws InvalidConfigException
@@ -2665,7 +2666,10 @@ public function setPaymentAmount(float $amount): void
     {
         $paymentCurrency = Plugin::getInstance()->getPaymentCurrencies()->getPaymentCurrencyByIso($this->getPaymentCurrency());
         $amount = Currency::round($amount, $paymentCurrency);
-        $this->_paymentAmount = $amount;
+
+        if($amount <= 0) {
+            $this->_paymentAmount = $amount;
+        }
     }
 
     /**