Drupal Warns of Critical Commerce Core Flaw in Active Attacks
Drupal has issued an urgent advisory warning administrators to patch a critical access bypass vulnerability affecting the Commerce Core module, noting that the flaw is currently being exploited in the wild.
Radwan AbdulhadiEditor and technology writer
Critical Vulnerability Discovered in Commerce Core
Drupal has issued a high-priority warning to administrators, urging them to patch a critical access bypass vulnerability affecting the Commerce Core module. According to reports from BleepingComputer, threat actors are actively exploiting this security flaw in the wild.
Tracked under the identifier CVE-2026-118539, the vulnerability originates from a missing authorization weakness that can be abused by unauthenticated attackers. The issue impacts Commerce Core versions ranging from 0.0.0 through 2.41, as well as versions 3.0.0 through 3.3.13.
Scope and Impact on Online Stores
The Commerce Core module is a community-developed framework utilized by more than 42,000 websites, including numerous high-profile organizations such as research universities and Fortune 500 companies. It provides essential tools for building and managing e-commerce platforms and shopping applications on top of the Drupal Content Management System.
In an official advisory published regarding the issue, Drupal explained that the module fails to properly protect specific routes and entity fields, creating an access bypass condition that can result in direct financial impacts for online store vendors.
Severity Scoring and Immediate Action Required
The Drupal security team assigned the vulnerability a risk score of 21 out of 25, reflecting its high severity and the fact that unauthenticated attackers can exploit it regardless of how the module has been configured. SecurityWeek noted that store owners face potential financial risks due to the flaw.
Administrators managing instances on the 3.x branch are directed to upgrade immediately to Commerce Core 3.3.13, while those maintaining earlier versions should update to Commerce Core 8.x-2.41. Furthermore, security advisories emphasize that site operators should carefully audit their store orders for any unusual inconsistencies resulting from the exploitation.
Broader Drupal Security Landscape
This discovery coincides with a series of other security advisories and vulnerability patches issued by Drupal. Earlier in the year, administrators were alerted to critical remote code execution concerns, such as vulnerabilities patched in core components, and previous issues involving database abstraction APIs that also drew exploitation attempts.
With CISA having previously tracked multiple Drupal vulnerabilities in its Known Exploited Vulnerabilities catalog over recent years, website maintainers are continuously urged to apply security updates as promptly as possible to mitigate evolving threats.
Sources
- BleepingComputerDrupal warns of critical Commerce Core flaw exploited in attacks
- SecurityWeekDrupal Commerce Core Vulnerability Exploited Against Online Stores
Continue chronologically
Related stories
Drupal Warns of Active Exploits Against Commerce Core Flaw
Drupal urges online store owners to patch a critical Commerce Core access bypass vulnerability actively being exploited in the wild.
Drupal Patches Critical RCE Vulnerabilities and Warns
Drupal has issued patches for two critical remote code execution vulnerabilities affecting supported versions and warned of potential exploits.
CISA Warns of Critical Pre-Auth RCE Flaw in MikroTik RouterOS
CISA has issued a warning regarding a critical pre-authentication RCE vulnerability in MikroTik RouterOS that impacts network security.
CISA Confirms Active Exploitation of Maximum-Severity GitLab Flaw
CISA confirms active exploitation of a maximum-severity GitLab vulnerability tracked as CVE-2026-97229 and urges administrators to apply patches immediately.
