Drupal Commerce Core Vulnerability Exploited Against Online Stores

Drupal urged digital store operators to patch a critical access bypass vulnerability in its Commerce Core module, tracked as CVE-2026-118539, after confirming active in-the-wild exploitation. According to SecurityWeek's report, attackers are targeting live e-commerce deployments running the contributed software. The Commerce Core module provides essential shopping cart and checkout functionality across more than 42,000 Drupal websites worldwide. Drupal assigned the vulnerability a risk score of 21 out of 25, warning that unauthenticated attackers can exploit the flaw regardless of how the module is configured.

This technical report details the structural flaws behind the Commerce Core exploit, the threat profile facing online merchants, and the mitigation steps required immediately. The guidance is written for engineering leads, system administrators, and security professionals responsible for maintaining Drupal storefronts. Readers will find exact version numbers, details on concurrent vulnerability disclosures, and instructions for auditing merchant order records.

What broke in Drupal Commerce Core Vulnerability Exploited

The vulnerability arises from insufficient access controls governing critical transactional pathways within the Commerce Core module. Drupal explained that the software fails to protect specific application routes and entity fields, allowing untrusted HTTP requests to bypass authentication and authorization layers. In its advisory, Drupal stated that the module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. By interacting directly with these exposed endpoints, attackers can circumvent validation checks that ordinarily safeguard order state transitions, pricing parameters, and checkout integrity.

The severity of the issue is reflected in Drupal's internal risk assessment, which assigned CVE-2026-118539 a risk score of 21 out of 25. Under this evaluation framework, the vulnerability does not require unique store configurations, custom plugins, or authenticated user permissions to trigger. Any unauthenticated attacker can exploit the vulnerability across vulnerable installations. Because Commerce Core manages fundamental transaction processing, malicious actors can exploit the access bypass to force unauthorized state changes that manipulate checkout logic, leaving merchant stores exposed to significant financial disruption without raising standard authentication failures.

Who is exposed by Drupal Commerce Core Vulnerability Exploited

Exposure spans a significant portion of the open-source web, with official Drupal project statistics showing the Commerce Core module deployed on more than 42,000 websites worldwide. The flaw specifically impacts all 3.x releases prior to version 3.3.13, as well as earlier software releases prior to version 8.x-2.41. Store owners and organizations operating these unpatched branches for shopping carts, digital product catalogs, or customer checkout workflows face immediate risk from opportunistic scanning campaigns and automated attacks currently underway across public networks.

The exposure landscape is intensified by a broader security release Drupal published on October 28, which included 38 total advisories covering security flaws across 21 contributed projects. Nearly a dozen of those disclosures carried critical ratings, addressing vulnerabilities that could result in remote code execution or administrative account takeover. Within e-commerce environments, Drupal identified related bugs where orders processed through Stripe could be marked as paid without any actual payment being received. Deployments that run multiple contributed commerce extensions are therefore navigating overlapping threat surfaces during this active exploitation window.

What to do now about Drupal Commerce Core Vulnerability Exploited

Store administrators must upgrade production environments immediately to Commerce Core version 3.3.13 or version 8.x-2.41, depending on whether they maintain 3.x or legacy release branches. Applying these official updates restores protective route boundaries and enforces field-level entity permissions across all checkout pathways. Technical teams should deploy the fixes through their standard version-control workflows, verify that production web servers execute the updated code, and clear system caches to ensure deprecated route configurations no longer accept external traffic from unauthenticated web clients.

Because attackers are exploiting the flaw against live stores, applying software patches represents only the first phase of remediation. Drupal issued an explicit advisory notice stating that sites should audit their orders for inconsistencies as this vulnerability is being actively exploited. Security teams and store managers must examine recent transaction records, checking for anomalous order statuses, zero-dollar purchases, altered pricing values, or discrepancies between store checkout logs and external payment gateway settlements. Any inconsistent transaction should be isolated for immediate forensic investigation.

How the Drupal Commerce Core Vulnerability Exploited issue works

At its technical core, the exploit targets exposed application routes and entity fields that Drupal's access control mechanisms leave unprotected. When an unauthenticated remote client sends requests to these specific endpoints, the software executes transactional adjustments without validating user permissions or session authenticity. This allows threat actors to manipulate underlying entity data structures, modifying order attributes and payment completion signals directly. Because the application processes these requests without rejecting unauthorized callers, malicious actors can simulate legitimate purchasing actions or bypass checkout checkpoints that enforce vendor payment collection.

The vulnerability arrives amid persistent security challenges across Drupal's component architecture. On October 14, Drupal disclosed two critical remote code execution flaws: CVE-2026-108097 in core's Field UI module and CVE-2026-108099 in the Entity List module, both requiring certain contributed modules or custom code to enable exploitation. Concurrently, Drupal patched a moderately critical bug in the CAPTCHA module that allows protected forms to be submitted without solving new challenges, alongside confirmed proofs of concept for information disclosure vulnerabilities in Commerce Core and Media Alias Display.

What is still unknown about Drupal Commerce Core Vulnerability Exploited

While Drupal has confirmed that threat actors are actively exploiting the flaw, the organization has withheld several key operational details surrounding the attacks. The advisory does not disclose the specific exploitation payloads, the threat actors responsible for the campaigns, or the total number of compromised websites. Drupal has also refrained from sharing technical indicators of compromise or documenting how many online merchants have suffered direct monetary losses as a result of unauthorized order manipulations in the wild.

Crucially, Drupal has not confirmed whether attackers exploited CVE-2026-118539 as a zero-day before patches were made available to the public. The exact discovery timeline remains undisclosed. This development follows earlier attacks on the platform, including CVE-2026-9082, a highly critical SQL injection bug in Drupal core’s database abstraction API that affected PostgreSQL-backed sites and saw exploitation attempts in May. In the absence of detailed threat telemetry, administrators must rely entirely on internal transaction audits to determine whether their systems were targeted.