Do Son 
TL;DR
Drupal’s security team has rated an access bypass in Commerce Core “Highly critical” and confirmed active attacks. The Drupal Commerce vulnerability, tracked as CVE-2026-118539, scores 21 out of 25 on Drupal’s risk scale. According to advisory SA-CONTRIB-2026-254, “This vulnerability is being actively exploited in the wild.”
Commerce Core fails to protect certain routes and entity fields, which can cause financial losses for store owners. Attackers are already abusing the flaw. Upgrade to Commerce Core 3.3.13 or 8.x-2.41, then audit your orders.
Why It Matters
Commerce Core powers shopping carts and checkout on Drupal sites. Drupal.org’s project page shows about 42,000 sites reporting use of the module. Moreover, the advisory warns the bug “may financially impact the vendor,” so attacks hit store revenue directly.
How the Attack Works
The advisory states that the module “doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass.” Drupal’s risk string lists no access complexity and no authentication requirement. In addition, it marks the exploit status as “Exploit,” and the bug affects all site configurations.
Drupal has not published further technical details about this Drupal Commerce vulnerability. Dan Puccetti, Marcus Johansson and Robert Snyder reported the issue. The risk string also rates confidentiality and integrity impact as “Some.”
Affected Versions
- Commerce Core versions before 8.x-2.41
- Commerce Core 3.x versions before 3.3.13
Patch and Mitigation
Install Commerce Core 3.3.13 if you run the 3.x branch, or 8.x-2.41 for older sites. Drupal also advises, “Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited.” In practice, that means reviewing recent orders for unexpected prices, totals or status changes.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
