Drupal warns of critical Commerce Core flaw exploited in attacks

An access-bypass vulnerability occurs when software fails to verify whether a requester is allowed to use a route or modify data. That can let an unauthenticated attacker perform actions normally reserved for authorized users. In Commerce Core, the weakness affects certain routes and entity fields, which are parts of the module's shopping and ordering system.

The flaw is tracked as CVE-2026-118539. An attacker could reach a protected route or manipulate a protected entity field without logging in or meeting the required permission checks. Because Commerce Core supports carts, checkout forms, APIs, and online sales, unauthorized changes could affect orders or vendor finances.

The issue is critical because exploitation is already happening in the wild. Drupal called the advisory highly critical and urged administrators to upgrade immediately. Administrators should install the fixed release and audit orders for inconsistencies, since patching stops future exploitation but may not reveal earlier unauthorized changes.

Commerce Core versions 0.0.0 through 2.41 are affected, as are versions 3.0.0 through 3.3.13. These ranges cover both the earlier release line and the newer 3.x branch. Administrators need to identify which branch their site uses before selecting the update.

Drupal's security team told administrators on the 3.x branch to upgrade immediately to Commerce Core 3.3.13. For earlier versions, the advisory identifies Commerce Core 8.x-2.41 as the required update. The source presents these releases as the versions administrators should use to address the flaw.

The urgency comes from active exploitation, not merely the existence of a theoretical bug. After upgrading, administrators should also audit orders for inconsistencies. That second step matters because an update protects the system going forward, while an order review can help identify suspicious changes made before the patch was installed.

Protected routes control which actions a requester can reach, while entity fields hold data connected to Drupal objects such as commerce records. If authorization is missing, an attacker may access an action or alter a field without proving they have permission. The article does not list every possible unauthorized action, so the exact impact depends on the affected routes and fields.

A practical example is an unauthenticated attacker reaching a commerce route that should require authorization, then changing a protected value through that route or an API. Such changes could create inconsistencies in orders or affect how a vendor records a sale. The weakness therefore goes beyond ordinary website viewing.

Drupal specifically warns that the vulnerability may financially impact the vendor. Attackers are exploiting it in the wild, so administrators should patch immediately and inspect orders for irregularities. The advisory establishes the risk of unauthorized access and data changes, but does not provide a detailed attack sequence or confirmed financial-loss figure.

Commerce Core is used by more than 42,000 websites. It is a community-developed Drupal module that provides a framework for building and running e-commerce sites and shopping applications. Its reach includes high-profile organizations, such as Fortune 500 companies and research universities.

The module supports selling goods and services through shopping carts, checkout forms, and decoupled applications using APIs. A vulnerability in shared commerce functionality can therefore matter across different kinds of websites. The article identifies unauthorized access to certain routes and entity fields, rather than limiting the issue to one particular store design.

The scale makes active exploitation especially significant. Administrators across many sites must determine whether they run an affected version, apply the appropriate update, and review orders for inconsistencies. The source does not say how many sites were compromised, so the known figure is the number of websites using Commerce Core, not a confirmed victim count.

Installing the patch addresses the software weakness that allows unauthorized access. Without the update, an attacker may continue abusing insufficient protection on certain Commerce Core routes and entity fields. Drupal's security team therefore urged administrators to upgrade immediately, especially because exploitation is already occurring in the wild.

Checking orders serves a different purpose. It can reveal inconsistencies that may have resulted from unauthorized access before the update. For example, an administrator might find order information that does not match expected records, although the article does not specify which fields attackers changed or provide a confirmed compromise pattern.

The two actions work together. The update reduces the chance of new abuse, while the audit helps assess whether earlier abuse affected commerce data. Drupal explicitly recommends auditing orders, and it warns that the vulnerability may financially impact vendors. The source does not describe remediation steps for suspicious orders, so affected organizations would need to investigate those findings separately.

The Commerce Core incident follows several recent Drupal security warnings involving real-world exploitation. In May, Drupal warned about SQL injection vulnerability CVE-2026-9082 in its database abstraction API. The flaw could enable privilege escalation, information disclosure, and remote code execution.

Days later, CISA added CVE-2026-9082 to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch within three days. Two weeks before the Commerce Core warning, Drupal also patched remote code execution issues CVE-2026-108097 and CVE-2026-108099. Drupal said attackers could develop exploits for those flaws within hours or days.

Across the last several years, CISA has flagged five Drupal vulnerabilities exploited in the wild. Two were also abused by ransomware gangs. The pattern shows why the Commerce Core warning is urgent, although the source does not say that this specific flaw has entered the KEV Catalog or been used by ransomware groups.

A CMS manages website content and applications, while a module adds specialized capabilities. Commerce Core adds e-commerce functions to Drupal, including shopping carts, checkout forms, and APIs. Web routes point requests toward those functions. Entity fields store data attached to Drupal objects, such as commerce records. APIs let applications use supported functions without the usual page interface.

Authorization checks are the permission gates around those routes and fields. They should confirm that a requester may perform an action or change data before Drupal accepts the request. In this incident, Drupal said certain routes and entity fields were not sufficiently protected. That missing protection created an access bypass that unauthenticated attackers could exploit.

This layered relationship explains the response. A CMS hosts the system, Commerce Core supplies store features, and routes, fields, and APIs expose or hold the relevant functionality. If authorization fails at a sensitive point, the wider store may be affected. The article does not describe each internal check, so this is a general explanation applied to Drupal's advisory.