Drupal Commerce Core Vulnerability Exploited Against Online Stores

Drupal has disclosed that attackers are actively exploiting a severe access-control flaw in the Commerce Core contributed module, which powers shopping carts and checkout flows on over 42,000 sites. The bug, CVE-2026-118539, stems from insufficiently restricted routes and entity fields, letting unauthenticated attackers bypass permissions in ways that could cause direct financial losses for store operators. Drupal's security team scored the issue 21 out of 25 and is urging site owners to upgrade to version 3.3.13 or 8.x-2.41 and to carefully review past orders for signs of tampering, since the project has not disclosed exploitation details, attacker identities, or whether this was previously exploited as a zero-day.

The fix was part of a larger October 28 batch of 39 advisories covering 21 contributed projects, nearly a dozen rated critical, including issues enabling remote code execution, account takeovers, and a separate Commerce/Stripe flaw letting orders be marked paid without actual payment. A moderately critical CAPTCHA module bug, which allows resubmitting a protected form without solving a fresh challenge, was also patched; Drupal notes public exploit code exists for it, though no active attacks have been confirmed. Two unrelated information-disclosure issues, in Commerce Core and Media Alias Display, also reportedly have public proof-of-concept exploits.