Drupal has issued a public advisory warning that a critical flaw in the Commerce Core module is being actively exploited, placing online stores at risk of unauthorized changes to orders and other store data. Published on October 28, 2026, the advisory identifies missing access checks in routes and entity fields that could let attackers reach functions or modify data they should not control. Drupal assigned the issue a high risk score and urged administrators to apply updates and audit order records immediately.
What the vulnerability is
Drupal tracked the issue as CVE-2026-118539. The underlying problem is insufficient protection around certain routes (endpoints that handle website requests) and entity fields (the data attached to site records). When access checks are missing, attackers can potentially invoke functions or alter fields without the permissions they should require. Drupal’s advisory confirms active exploitation but does not document every detail of the observed attacks, such as exact fields changed or the full attack method.
Scope and affected installations
Commerce Core powers shopping carts, checkout forms, and API-connected storefronts. The module’s project page reports more than 42,000 installations, though that figure reflects reported installs rather than confirmed vulnerable or compromised stores. Drupal’s advisory states the vulnerability affects Commerce Core versions before 2.41 and versions from 3.0.0 up to, but not including, 3.3.13. Sites on the 3.x branch should upgrade to Commerce Core 3.3.13; earlier branch users should move to Commerce Core 8.x-2.41 as directed by Drupal.
Potential impact and what’s been observed
Drupal rated the flaw 21 out of 25 on its internal risk scale and categorized it as “Highly critical.” The advisory indicates exploitation requires no authentication and could expose some private information and allow changes to certain data. Drupal has confirmed active exploitation but has not published names of affected stores, attack volumes, or proof of remote code execution or full website takeover. Media reports and community posts have circulated claims that attackers could purchase items for $0.01, but the official advisory does not confirm that exact outcome; it notes a potential financial impact without specifying manipulated fields or prices.
Immediate mitigation steps
1. Patch immediately: Follow Drupal’s guidance and update Commerce Core to the fixed versions — 3.3.13 for the 3.x branch or 8.x-2.41 for earlier branches. These are Commerce module updates separate from Drupal core releases; check the installed Commerce package rather than assuming a core update suffices.
2. Audit orders: Compare recorded orders with expected prices and payment records. Investigate unexplained differences instead of dismissing them as anomalies. Look for orders with unexpected price changes, missing payments, or mismatched transaction IDs.
3. Harden access controls: Review custom routes, API endpoints, and entity field permissions on affected sites to ensure proper access checks are enforced.
Detection, monitoring, and response
– Give your SOC contextual alerts that include the advisory details (CVE-2026-118539), affected versions, and indicators of unusual order activity so incidents can be triaged quickly.
– Integrate threat intelligence feeds and logs into monitoring tools to flag sudden changes in order values, atypical admin API calls, or unauthorized edits to product and order entities.
– Perform forensic checks on logs and payment provider records for the window prior to patching to estimate exposure and identify potentially compromised orders.
– Remediate by rolling back malicious changes where possible, coordinating with payment processors to reconcile transactions, and notifying affected customers if necessary.
How this differs from other e-commerce threats
This advisory centers on broken access controls that enable unauthorized changes by exploiting module routes and fields. That pattern differs from Magecart-style attacks, which target checkout pages to steal customer payment details. Drupal’s advisory stops short of asserting remote code execution or full site takeover; the primary concern is unauthorized data modification and resulting financial loss.
Attribution and reporting
The vulnerability was reported by researchers Dan Puccetti, Marcus Johansson, and Robert Snyder. Drupal’s public advisory confirms active exploitation but omits detailed attack techniques, affected site names, and exploitation volume. Store owners and administrators should treat the advisory as authoritative and follow the recommended updates and auditing steps.
What to communicate and next steps
Prioritize patching Commerce Core immediately. After updating, continue to audit historical orders and monitor for post-patch anomalies. Share concise, actionable alerts with security operations teams and coordinate with payment processors and legal/compliance teams if evidence suggests financial impact. Maintain vigilance even after patching — the advisory underscores active exploitation and the need for careful verification of order integrity.
Licensed under CC BY-ND 4.0 International