The Drupal security team has warned that attackers are exploiting a missing-authorization flaw in Commerce Core, the module many Drupal sites use to run shopping carts and checkout. Tracked as CVE-2026-118539 (SA-CONTRIB-2026-254, published 28 October and rated “highly critical”), it says the module “doesn’t sufficiently protect certain routes and entity fields,” allowing an access bypass that “may financially impact the vendor.” BleepingComputer describes it as abusable by unauthenticated attackers and says Commerce Core is used by more than 42,000 sites. Drupal says the flaw is being actively exploited but, as The Hacker News notes, has not described the activity or how widespread it is. No CVSS score has been assigned yet.
Drupal tells site owners to audit their orders for inconsistencies in addition to updating. This is a different flaw from the Field UI one fixed in Drupal core earlier this month (Drupal Patches Critical Field UI Flaw That Can Lead to RCE).
How to check if you’re affected
Affected versions, per Drupal’s advisory, are Commerce Core releases below 2.41 on the 8.x-2.x line and from 3.0.0 up to but not including 3.3.13. Both BleepingComputer and The Hacker News describe the ranges as running “through” 2.41 and 3.3.13, which would include the fixed releases, so rely on the advisory’s wording and its stated fix versions.
- Check which Commerce Core version your site runs (for example in your Composer lock file or the site’s module list).
- On the 3.x branch, upgrade to Commerce Core 3.3.13. On earlier versions, upgrade to Commerce Core 8.x-2.41.
- Audit recent orders for inconsistencies, as Drupal advises. Drupal has not published specific indicators of what to look for.