Attackers exploiting a missing-authorisation flaw

Drupal has warned that attackers are exploiting a highly critical flaw in its Commerce Core component, the module powering carts, checkout, orders and payments on Drupal stores. The flaw, tracked as CVE-2026-118539, is a missing-authorisation weakness: certain routes and entity fields are not sufficiently protected, allowing an access bypass that may have a financial impact on store owners. Drupal rated it 21 out of 25, its highly critical band, and said it is being actively exploited in the wild.

The flaw affects Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. Fixes were released on 28 October 2026: version 3.3.13 for the 3.x line and 8.x-2.41 for earlier versions. The module is installed on more than 42,000 sites, according to Drupal statistics cited in coverage, although that describes adoption, not sites attacked.

What store owners should check

The maintainers of Drupal Commerce, Centarro, said they received two reports of attempts by malicious users to place fraudulent orders using the flaw. In the pattern described, orders appeared as paid in the order system while having no payment records attached — in effect, payment was simulated without money changing hands. Centarro said that, as of its post, it did not believe the issue had been scripted or exploited beyond the initial sites, but the Drupal advisory itself gives no routes, indicators or workaround beyond updating.

That gap is why the advice goes beyond patching. Store owners are urged to update immediately, then audit orders for inconsistencies, comparing order records with payment-processor settlements and looking back as far as logs allow, since the advisory does not say when exploitation began. Patching closes the known path; it does not by itself prove a store was untouched before the fix.