Drupal warns of critical Commerce Core flaw exploited in attacks

Drupal issued a security advisory warning administrators to patch an access bypass vulnerability in the Commerce Core module that attackers are actively exploiting in the wild. According to BleepingComputer's report, the missing authorization weakness allows unauthenticated threat actors to bypass security controls and cause financial harm to online merchants. Maintainers tagged the incident as highly critical because attackers can abuse unprotected endpoints without credentials.

This article examines the authorization flaw, affected Commerce Core versions, active exploitation in production environments, and immediate remediation steps for administrators. It is written for e-commerce engineers, security teams, and IT directors responsible for maintaining Drupal storefronts across enterprise environments, academic institutions, and decoupled web applications.

What broke in Drupal warns of critical Commerce Core flaw

The breakdown stems from a missing authorization weakness tracked as CVE-2026-118539 in the module's routing and field systems. Maintainers issued a Wednesday advisory tagged as highly critical to highlight that the code fails to protect sensitive processing pipelines. As Drupal confirmed, "The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. This vulnerability is being actively exploited in the wild." Because permissions are not enforced, unauthenticated attackers can interact with transactional states that normally require authenticated access.

The module provides an e-commerce architecture for merchants. In its warning, Drupal explained, "This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs." When authorization logic fails across these checkout endpoints, external threat actors can bypass payment constraints, tamper with pricing structures, or alter order entity properties without verification. This breakdown permits attackers to inject unauthorized modifications directly into live transactions, producing severe accounting discrepancies and direct financial deficits for store owners.

Who is exposed by Drupal warns of critical Commerce Core flaw

The vulnerability exposes a broad footprint across the web because Commerce Core is a community-developed Drupal module used by more than 42,000 websites. The software provides a framework for building and running e-commerce sites and shopping apps on top of the Drupal Content Management System. Its user base includes high-profile organizations such as Fortune 500 companies and research universities. Any enterprise or academic institution relying on this module for commercial intake remains exposed to exploitation if their systems run unpatched software versions.

Exposure covers multiple software versions across both legacy and modern deployment branches. The flaw affects Commerce Core versions 0.0.0 through 2.41 alongside releases spanning versions 3.0.0 through 3.3.13. Because the missing authorization weakness compromises embedded checkout forms and decoupled application programming interfaces, organizations utilizing headless web frontends or traditional integrated templates share the exact same risk profile. Attackers scanning public web networks can identify exposed endpoints regardless of the visual design or customer interface deployed on top of the underlying CMS.

What to do now about Drupal warns of critical Commerce Core flaw

The Drupal security team asked administrators on the 3.x branch to upgrade immediately to Commerce Core 3.3.13 to close the vulnerable code paths. Store operators running earlier versions must update directly to Commerce Core 8.x-2.41 without delay. Because threat actors are actively exploiting this security defect in the wild, deployment teams should treat these patches as high-priority emergency changes and apply them across production, staging, and disaster recovery environments before running normal release cycles or standard maintenance schedules.

In addition to applying software patches, Drupal told administrators to audit orders for inconsistencies across all storefront databases. Security teams must review purchase histories, order entity states, checkout logs, and payment confirmations to detect fraudulent price alterations or manipulated field values. Forensic analysis is essential because defensive controls degrade once malicious operators establish footholds; findings from The Blue Report 2026 across 338 million simulations run in customer production environments show that once attackers have valid credentials, prevention drops sharply and defenses block only 37% of their actions.

How the Drupal warns of critical Commerce Core flaw issue works

The technical mechanics of CVE-2026-118539 rely on an unauthenticated access bypass caused by the omission of necessary authorization checks on internal routing endpoints and entity fields. When Drupal routes network requests to Commerce Core controllers, the application does not verify whether the client holds the requisite permissions to read or write specific entity properties. Consequently, unauthenticated attackers can craft specialized requests against the shopping cart, checkout endpoints, or API interfaces without submitting legitimate session cookies, administrative login credentials, or user access tokens.

Once an attacker sends requests against the exposed routes, the application processes the instructions as legitimate commands. This behavior allows threat actors to interact directly with internal data models, bypassing payment logic and modifying order records stored within database tables. Because the missing authorization flaw functions at the entity field level, decoupled applications that communicate with Drupal through backend application programming interfaces are equally vulnerable to malicious requests that bypass presentation-layer business rules and alter commercial transactions.

What is still unknown about Drupal warns of critical Commerce Core flaw

The security advisory does not provide technical details regarding the specific threat actors executing the live attacks, nor does it identify which retail sectors have suffered financial losses. It remains unstated whether the active exploitation involves automated vulnerability scanners deploying indiscriminate attacks across the 42,000 installations or targeted campaigns orchestrated by advanced persistent threat groups. In historical campaigns documented over recent years, CISA has flagged 5 Drupal vulnerabilities exploited in the wild, two of which have also been abused by ransomware gangs.

Authorities have not confirmed whether the Cybersecurity and Infrastructure Security Agency will add CVE-2026-118539 to its Known Exploited Vulnerabilities Catalog and mandate federal patching. In May, Drupal warned that attackers were exploiting an SQL injection vulnerability (CVE-2026-9082) in the database abstraction API that could lead to privilege escalation, information disclosure, and remote code execution, prompting CISA to order federal patching within three days. Two weeks ago, Drupal also patched two remote code execution security issues (CVE-2026-108097 and CVE-2026-108099), warning that attackers could develop exploits within hours or days.