Run an Online Store on Drupal? Attackers Are Already Using a Commerce Core Flaw That Needs No Login. Five Steps for Today
Drupal has warned that a highly critical access bypass flaw in Commerce Core, CVE-2026-118539, is being exploited against online stores, and that attackers do not need an account to use it. Here is what to update, what to check in your orders and what is still unknown.
Drupal’s security team published an advisory on Wednesday with a warning store owners should not ignore: the bug it fixes is already being exploited. The flaw, tracked as CVE-2026-118539, sits in Commerce Core, the module that turns a Drupal site into a store with a cart, checkout and order history. More than 42,000 websites use it, and Drupal says attackers are already abusing the bug in the wild.
This summary draws on SecurityWeek’s report on the exploited Commerce Core flaw, with additional background from BleepingComputer and The Hacker News.
Why this one jumps the queue
The problem is a missing authorization check, which Drupal classifies as an access bypass. In plain terms, a part of the store that should ask “are you allowed to do this?” does not ask. Drupal says the module does not adequately protect certain routes and entity fields, and that the resulting bypass could cause financial harm to the store. It rates the issue highly critical, with a risk score of 21 out of 25, and says it can be exploited by an attacker who has no account on the site, no matter how the site is configured.
Five steps for store owners and their web teams
- Find out whether you run Commerce Core. If your site takes orders through Drupal, ask your developer or hosting partner to confirm which version of the Commerce module is installed.
- Update now. The fix is in Commerce Core 3.3.13 for the current 3.x branch, and in 8.x-2.41 for sites still on the older 2.x line. Anything earlier on either branch is affected.
- Audit recent orders. Drupal specifically advises site owners to review their orders for inconsistencies. Look for orders whose status, totals or payment records do not line up, and compare them against what your payment processor actually received.
- Apply the rest of this week’s fixes. The Commerce advisory was one of 38 Drupal published on October 28 across 21 contributed projects. Nearly a dozen were rated critical, including flaws that allow remote code execution and account takeover, and one bug in a Stripe payment module that could mark a Commerce order as paid when no payment was made.
- Keep watching. Ask whoever manages the site to check Drupal’s advisory page for updates, since more details about the attacks may follow.
What is known and what is not
- Known: the flaw is being exploited, it needs no login, and patched versions are available.
- Not yet known: how attackers are using it, who is behind the activity, how many stores have been hit, and whether it was used before the fix existed. Drupal has not shared those details.
A busy year for Drupal patching
This is not the first urgent Drupal warning of 2026. In May, the project fixed CVE-2026-9082, a SQL injection bug in sites backed by PostgreSQL databases, and exploitation attempts followed. Earlier this month, on October 14, Drupal patched remote code execution flaws in the Field UI and Entity List modules; there have been no public reports of those being exploited so far. The U.S. Cybersecurity and Infrastructure Security Agency has flagged five Drupal flaws as exploited over the years, two of them in ransomware attacks.
What this means for your company
An online store is a money-handling system, so it deserves the same patch urgency as your accounting software. Whatever platform you sell on, know who is responsible for applying security updates, how quickly they are expected to do it, and how you would spot an order that was never really paid for. Regularly reconciling store orders against payment processor records is a simple habit that catches problems from bugs and fraud alike.
Not sure who is keeping your online store patched, or how quickly? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
