Drupal Warns of Critical Commerce Core Flaw Exploited

Drupal has told admins to patch CVE-2026-118539 in the Commerce Core module right away, because attackers are already exploiting it. The flaw is a missing authorization weakness that unauthenticated attackers can abuse, according to BleepingComputer's report.

If you run a Drupal store, update the module first. Then check your orders for signs of tampering.

What happened

Drupal's security team published an advisory, tagged highly critical, about an access bypass in Commerce Core. The module sells goods and services through a shopping cart and checkout form, or through decoupled applications that use APIs.

Drupal's own wording is blunt: the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor." The advisory also states that the vulnerability is being actively exploited in the wild.

The security team asked admins on the 3.x branch to upgrade immediately and to audit orders for inconsistencies.

Affected and fixed versions

The report lists these ranges:

The ranges list 3.3.13 as both the last affected release and the upgrade target. Confirm the exact fixed release on the Drupal advisory linked from the BleepingComputer report before you deploy.

Commerce Core is used by more than 42,000 websites, including Fortune 500 companies and research universities. Any site that sells through Drupal Commerce should treat itself as in scope until it has checked its version.

How serious it is

This is a high-risk bug for three reasons:

• Attackers do not need an account.

• Exploitation is already happening.

• The impact is financial: the advisory says it may hit the vendor's revenue.

A store with tampered orders can ship goods or grant access without proper payment. Refunds and chargebacks can follow.

This is also not Drupal's first alarm this year. In May, Drupal warned about an exploited SQL injection flaw (CVE-2026-9082), and CISA ordered federal agencies to patch it within three days. Two weeks before the Commerce Core report, Drupal patched two remote code execution issues (CVE-2026-108097 and CVE-2026-108099) and warned that attackers could build exploits "within hours or days." CISA has flagged 5 Drupal vulnerabilities as exploited in the wild, and two of them were also abused by ransomware gangs.

Patch and check your exposure now

Work through these steps in order. Run them on staging first if you can, but do not let testing delay the fix for long.

1. Back up the database and codebase.

2. Check which Commerce version you run.

3. Update the module and run database updates.

4. Clear caches and test checkout.

Start with the version check and the update. These commands assume a Composer-managed site with Drush:

composer show drupal/commerce
drush pm:list --type=module --status=enabled | grep -i commerce
composer update drupal/commerce --with-all-dependencies
drush updatedb -y
drush cache:rebuild

If Composer pins an older release, loosen the constraint in composer.json so it allows the fixed version. Then rerun composer show drupal/commerce and confirm the number.

While you plan the update, reduce exposure. If you use decoupled front ends, review which API routes are public. A web application firewall rule that blocks unauthenticated write requests to order and cart endpoints can buy time. It does not replace the patch.

Look for suspicious requests

The advisory names unprotected "routes and entity fields" but does not publish exact paths. Use this search as a rough first pass, and adjust the log path and URL patterns to your site:

grep -E '"(POST|PATCH|DELETE) ' /var/log/apache2/access.log | grep -Ei '/(jsonapi|cart|checkout|order)' | less

Look for write requests from addresses that never logged in. Also look for bursts of requests to the same endpoint.

Audit your orders for tampering

Drupal told admins to audit orders for inconsistencies. A practical way is to query the commerce_order table for recent changes and impossible values. Change the date to cover the period before you patched:

SELECT order_id, state, total_price__number, total_price__currency_code, mail, FROM_UNIXTIME(changed) AS last_changed
FROM commerce_order
WHERE changed >= UNIX_TIMESTAMP('2026-10-01')
ORDER BY changed DESC
LIMIT 200;

SELECT order_id, state, total_price__number
FROM commerce_order
WHERE state = 'completed' AND total_price__number <= 0;

Here is a worked example. Suppose a completed order shows a total of 0.00, but your payment provider has no matching charge. Treat that order as suspect. Hold fulfillment, compare it against your payment records, and note the order ID and timestamps for your incident log.

Then compare completed orders against payment provider reports line by line. Mismatches in amount, status, or customer email are the signs to chase.

If the audit finds anything, rotate admin credentials and review user accounts and roles. Our GitLab patch-now write-up follows the same patch, verify, then hunt routine. If a breach touched customer data, check what your policy covers using our cyber risk insurance checklist.

What learners can take from this

This bug is a textbook broken access control case. The code worked as designed, but certain routes and fields lacked authorization checks. Exam objectives on access control, secure design, and vulnerability management all come back to this: deny by default, and verify every route and field.

It is also a good patch-management exercise. You identify the version, test the fix, deploy it, and validate the result. If you want a structured path into this work, browse our cybersecurity certification vouchers.

Sources

• Drupal warns of critical Commerce Core flaw exploited in attacks (BleepingComputer)