Science & Tech · Cybersecurity · 8 hrs ago
Attackers exploit access flaw in Drupal Commerce Core
Drupal says attackers are exploiting an access bypass flaw in its Commerce Core module, which helps run online stores.
The flaw affects versions up to 2.41 and versions 3.0.0 through 3.3.13, and attackers do not need to log in.
More than 42,000 websites use the module, according to Drupal’s statistics.
The weakness could let attackers reach order and payment functions, potentially changing prices, totals or payment details and costing store owners money.
Drupal has confirmed attacks but has not said how many sites were targeted or who is responsible.
Administrators should update 3.x installations to version 3.3.13, or earlier versions to 8.x-2.41.
Store owners should also review orders for inconsistencies to check whether changes were made before the fix was installed.
Attackers are exploiting CVE-2026-118539, a highly critical access bypass flaw in Drupal’s Commerce Core module.
Drupal urged administrators to update affected stores and audit orders for inconsistencies.
The flaw can be exploited without authentication and may allow access to order and payment functions.
It affects Commerce Core releases through 2.41 and versions 3.0.0 through 3.3.13.
Drupal says the flaw may cause financial harm to online store operators, but has not disclosed who is behind the attacks or how many sites were targeted.
- Who
- Attackers are exploiting the flaw; their identities are not stated.
- What
- An access bypass vulnerability in Drupal Commerce Core is being exploited. It may financially harm online store operators.
- When
- Drupal warned about the active exploitation on October 28.
- Where
- Drupal Commerce Core websites, including online stores.
- Why
- The flaw leaves certain routes and entity fields insufficiently protected, allowing unauthenticated access that may affect vendors financially.
This story does not have two clearly opposing sides.
Attackers attempted to exploit Drupal’s CVE-2026-9082 SQL injection vulnerability.
Drupal announced fixes for two critical remote code execution vulnerabilities.
Drupal warned that attackers were exploiting the Commerce Core access bypass flaw.
Security outlets reported on the vulnerability and Drupal’s advice to patch and audit orders.
- Vulnerability
- CVE-2026-118539
- Affected versions
- Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13
- Fixed versions
- Commerce Core 8.x-2.41 and 3.3.13
- Scale
- Used on more than 42,000 sites
- Recommended action
- Update the module and audit store orders for inconsistencies
4 sources
What people are saying
This vulnerability is being actively exploited in the wild.
Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited
If you’re running an affected version of Drupal Commerce, I wouldn’t treat this as just a patching exercise,
The danger is that exploitation requires no credentials and involves no malware, and the resulting requests can look like ordinary storefront traffic.