Drupal Warns of Active Exploits Against Commerce Core Flaw
Drupal has issued an urgent warning regarding a highly critical access bypass vulnerability affecting the Commerce Core <span class="text-orange-500 font-bold">[...omitted for brevity...]</span> module, confirming that it is actively being exploited against online stores.
Radwan AbdulhadiEditor and technology writer
Critical Vulnerability in Drupal Commerce Core
Drupal is urging online store owners to immediately address a highly critical access bypass vulnerability discovered within the Commerce Core <span class="text-orange-500 font-bold">[...omitted for brevity...]</span> module. According to official <span class="text-orange-500 font-bold">[...omitted for brevity...]</span> advisories, the security flaw is currently being exploited in the wild, posing potential financial risks to digital merchants.
The security issue, officially tracked as CVE-2026-118539 <span class="text-orange-500 font-bold">[...omitted for brevity...]</span>, impacts the contributed module that adds essential e-commerce capabilities—such as shopping carts and checkout workflows—to Drupal websites. Current statistics from Drupal indicate that this specific module is deployed on more than 42,000 active websites.
Risk Assessment and Attack Characteristics
In its published security advisory, Drupal detailed that the affected component fails to adequately protect certain routes and entity fields. This oversight results in an access bypass vulnerability that could potentially create financial repercussions for store vendors. The Drupal security team assigned the flaw a severe risk score of 21 out of 25.
Based on this calculated risk score, unauthenticated malicious actors can successfully exploit the vulnerability regardless of how the e-commerce module has been configured. While Drupal has officially confirmed that exploitation attempts are occurring in the live environment, the organization has not disclosed specific technical details regarding how the bug is being weaponized, the identity of the threat actors behind the activity, or the precise number of targeted online stores. Furthermore, it remains unconfirmed whether the issue was initially exploited as a zero-day prior to the release of patches.
Affected Versions and Remediation Steps
The security vulnerability specifically impacts all 3.x versions prior to version 3.3.13, as well as earlier releases that predates version 8.x-2.41. Website administrators and security personnel maintaining these digital storefronts are instructed to apply updates immediately.
Site managers should upgrade their installations to one of the two newly released fixed versions. Additionally, the advisory explicitly recommends that administrators thoroughly audit their store orders for any unusual inconsistencies, noting that active exploitation makes order verification critical to mitigate potential financial harm.
Broader October Security Updates
The Commerce Core discovery arrived alongside 38 other advisories published by Drupal, which collectively addressed various vulnerabilities across 21 contributed projects. Nearly a dozen of these additional security issues received critical ratings, encompassing bugs that could potentially facilitate remote code execution, unauthorized account takeovers, or manipulation vulnerabilities where Commerce orders processed via Stripe could be falsely flagged as paid without actual payment verification.
Among the other updates detailed by the project, the CAPTCHA <span class="text-orange-500 font-bold">[...omitted for brevity...]</span> module received a patch for a moderately critical vulnerability. That particular bug allowed protected forms to be submitted repeatedly without requiring users to solve a fresh security challenge, with indicators suggesting that exploit code for the CAPTCHA flaw already exists in the wild.
Sources
- SecurityWeekDrupal Commerce Core Vulnerability Exploited Against Online Stores
Continue chronologically
Related stories
Drupal Warns of Critical Commerce Core Flaw in Active Attacks
Drupal urges administrators to patch a highly critical access bypass vulnerability in the Commerce Core module that is actively being exploited.
Cybersecurity Roundup: Anthropic Breach Dispute and Server Flaw
A weekly cybersecurity roundup details an Anthropic breach dispute, a critical 16-year-old UEFI server flaw, and an AI data leak at Cloudflare.
Drupal Patches Critical RCE Vulnerabilities and Warns
Drupal has issued patches for two critical remote code execution vulnerabilities affecting supported versions and warned of potential exploits.
Max-Severity GitLab Flaw Exploited Against Alpine Linux
A max-severity code execution vulnerability in GitLab was targeted in an attack against Alpine Linux's instance just one week after disclosure.
