Drupal has warned that attackers are actively exploiting a highly critical security flaw in Commerce Core, putting online stores at risk of financial loss.
Tracked as CVE-2026-118539, the vulnerability allows adversaries to bypass access checks in the Commerce module used to sell products and services on Drupal sites and on connected shopping applications.
The advisory raises concerns about unauthorized changes to store data and transactions but does not confirm reports that attackers can purchase items for exactly $0.01. Drupal’s public advisory does not document that price, does not name which fields attackers can change, and does not describe the precise methods observed in attacks.
Published on October 28, 2026, the official Drupal security notice identifies insufficient access protection around certain routes and entity fields. Routes handle requests to site functions, while entity fields store data associated with site records. Missing access checks can let an attacker reach functionality or data they should not be able to control.
Critical Drupal Commerce vulnerability
Drupal gave the flaw a risk score of 21 out of 25 on its own security scale, classifying it as “Highly critical” (this is not a CVSS score). The assessment states that exploitation requires no authentication and can affect all configurations of the vulnerable module versions.
Drupal confirmed active exploitation but has not released the names of affected stores, the volume of attacks, or a detailed attack method. The advisory also does not indicate remote code execution or a complete site takeover as a consequence of this issue, although it warns of possible exposure of some private information and modification of some data.
Commerce Core provides shopping carts, checkout forms, and APIs for connected applications. The project page reports more than 42,000 sites using the module; that number reflects reported installations, not confirmed vulnerable or compromised stores.
The vulnerability affects Commerce Core 2.x versions earlier than 2.41, and 3.x versions from 3.0.0 up to (but not including) 3.3.13. Administrators running the 3.x branch should upgrade to Commerce Core 3.3.13. Sites on older 2.x releases should update to Commerce Core 8.x-2.41, following Drupal’s published guidance.
These are Commerce module updates, separate from Drupal core security releases. Earlier coverage of a critical Drupal remote code execution flaw concerned a different issue; store owners should verify the installed Commerce package rather than assume a recent Drupal core update resolved this vulnerability.
Drupal explicitly advises affected sites to audit orders for inconsistencies because exploitation is already underway. In addition to applying the update, site owners should compare recorded orders with expected prices and payment records and investigate unexplained discrepancies rather than treating them as automatic proof of compromise.
This threat is distinct from Magecart-style attacks that target checkout pages to steal customer payment details. Drupal’s warning focuses on broken access controls and the potential for merchant losses rather than on payment-card theft.
The flaw was reported by researchers Dan Puccetti, Marcus Johansson, and Robert Snyder. Prompt patching and careful order audits are the immediate priorities for affected online stores.
Give your SOC the alert context to stop incidents quickly. Integrate threat intel from thousands of SOCs.
