Drupal Commerce Core access bypass being actively exploited

Drupal Commerce Core has a critical access bypass that attackers are using in the wild, and the project is asking site operators to update immediately. According to BleepingComputer, the flaw, tracked as CVE-2026-118539, comes from a missing authorization control and affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.

Drupal Commerce Core: what is vulnerable

The Commerce Core module provides the framework for running e-commerce functions on Drupal, including shopping carts, checkout forms, and APIs for decoupled apps, the advisory noted. Drupal advised administrators on the 3.x branch to upgrade immediately to Commerce Core 3.3.13, and users on earlier releases to move to Commerce Core 8.x-2.41, because the module "is being actively exploited in the wild," according to BleepingComputer.

The flaw is an authorization problem, meaning certain routes and entity fields are not sufficiently protected and can be bypassed by unauthenticated attackers. Drupal's advisory called the issue highly critical and warned that it may have financial consequences for vendors that operate affected stores.

Who is affected and why it matters

Commerce Core is a widely used, community-developed Drupal module. BleepingComputer reported it is installed on more than 42,000 websites, including high-profile organizations such as Fortune 500 companies and research universities. That reach makes the module an attractive target for attackers who want to manipulate store data or financial transactions.

The Hacker News also covered the advisory and noted that Drupal credited the researchers who reported the issue. Both outlets underline that Drupal provided upgrade guidance but did not publish detailed technical specifics about the active exploitation campaign.

Threat context and recent Drupal incidents

This advisory follows multiple serious Drupal security notices earlier in the year. BleepingComputer reported that in May attackers were exploiting an SQL injection issue in Drupal's database abstraction API (CVE-2026-9082), which CISA later added to its Known Exploited Vulnerabilities catalog. Drupal also patched two remote code execution vulnerabilities two weeks before this Commerce Core advisory. Those prior incidents highlight that active exploitation of Drupal flaws has been a recurring problem.

Immediate actions to take

• Patch now: Upgrade Commerce Core to 3.3.13 if you run the 3.x branch, or to Commerce Core 8.x-2.41 for earlier branches, as Drupal advised. Applying the update is the highest priority.
• Audit orders: Check recent orders and payment records for unusual or inconsistent activity, per Drupal's advisory.
• Restrict exposure: If the module is not required, consider disabling it until you can apply and test the update.
• Monitor logs: Watch web, application, and payment logs for unexpected accesses, new accounts, or changes to order data.
• Review access controls: Verify who has admin and store-management permissions and remove unused accounts or excessive privileges.
• Test updates in staging: Apply the update in a staging environment first, then deploy during a maintenance window.
• Consider blocking or filtering: Use your web application firewall or blocking rules to reduce exposure while you update.

If you want a quick external check of your site surface, start with a free external scan: /security.html.

Longer term steps and practical checks

• Inventory modules: Keep a list of e-commerce related modules and track when each one has security updates available. Modules with wide integration into checkout and order flows deserve higher priority for review.
• Incident playbook: Ensure you have a repeatable process for investigating suspicious orders, including preserving logs and enabling forensic snapshots when feasible.
• Patch cadence: Given the recent string of Drupal advisories and active exploits, consider shortening how often you check for core and module updates.
• Backup and recovery: Confirm backups are current and you can restore both site files and the database quickly if a compromise is discovered.

What to watch for next

Drupal has not published detailed exploit samples or a public timeline for the campaigns using this vulnerability. Reports in the media focus on the advisory and upgrade guidance rather than on technical indicators of compromise. For now, prioritize patching, auditing order data, and monitoring logs as the practical steps to reduce risk. BleepingComputer and other outlets are the reporting sources for this advisory and will likely carry further details if Drupal releases more information.

If you run an e-commerce site on Drupal, treat this as a high-priority maintenance task: apply the advised updates, check order integrity, and tighten access around store administration functions. Doing those things will reduce the chance an attacker can abuse the missing authorization checks that this advisory describes.