Actively Exploited Drupal Commerce Core Flaw Exposes Online Stores to Authorization Bypass

Drupal has issued an urgent warning that attackers are already exploiting a "highly critical" vulnerability in the Commerce Core module, a widely used component that powers shopping carts and storefronts on Drupal-based sites. The flaw, tracked as CVE-2026-118539, is a missing authorization issue that could allow unauthenticated actors to perform actions they should never be permitted to carry out.

According to the advisory reported by The Hacker News, the vulnerability affects Commerce Core versions from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13. No CVSS score was published alongside the disclosure, but Drupal's "highly critical" designation signals that site operators should treat remediation as an immediate priority.

What the Flaw Means in Practice

Commerce Core is the engine behind e-commerce functionality on Drupal sites, enabling merchants to sell goods and services through an integrated shopping cart, checkout flow, and order management system. Because that module sits directly in the path of customer transactions and administrative order handling, an authorization bypass in this component is especially dangerous.

Missing authorization vulnerabilities occur when an application fails to verify that the requesting user actually holds the privileges required for a given operation. Rather than exploiting a memory corruption bug or injecting malicious code, an attacker simply asks the application to perform a privileged action and the system complies because the permission check is absent or incomplete.

In an e-commerce context, the potential consequences are significant. Depending on how the affected code paths are exposed, an attacker could reach functionality intended to be restricted to authenticated staff or customers. That could translate into unauthorized access to order data, manipulation of cart or checkout state, or other actions that undermine the integrity of a storefront. Drupal has not publicly detailed the precise exploitation mechanics, and defenders should avoid assuming the impact is limited to any single scenario.

Why Active Exploitation Changes the Calculus

The fact that exploitation is already underway removes any remaining window for a leisurely patch cycle. When a vulnerability is being actively exploited in the wild, publicly available proof-of-concept code or scanning activity often follows quickly, and mass exploitation against unpatched sites becomes a realistic near-term risk.

Drupal's security team has a strong track record of coordinated disclosure, and the Commerce Core maintainers have released fixed versions. Site owners running affected releases should upgrade to a patched version immediately rather than waiting for a scheduled maintenance window.

Recommended Remediation Steps

  • Inventory your exposure. Determine whether Commerce Core is installed and confirm the exact version. Sites on the 2.x branch up to 2.41 and the 3.x branch up to 3.3.13 are in scope.
  • Patch without delay. Update to a release outside the affected ranges. Given active exploitation, treat this as an emergency change.
  • Review logs for abuse. Examine web server and application logs for unusual requests targeting Commerce endpoints, unexpected order activity, or anomalous access patterns that predate patching.
  • Rotate secrets if compromise is suspected. If indicators suggest unauthorized access, rotate API keys, payment gateway credentials, and administrative sessions.
  • Harden permissions. Audit Drupal role and permission configurations to ensure least-privilege principles are enforced across commerce-related functionality.

The Broader Pattern

This incident fits a familiar and uncomfortable trend: attackers increasingly target the plugin and module ecosystems layered on top of popular content management systems. Core platforms tend to receive rigorous scrutiny and rapid patching, but contributed modules—especially large, feature-rich ones like Commerce Core—carry substantial attack surface and are frequently deployed across thousands of sites with varying update discipline.

For merchants, the lesson is that e-commerce extensions deserve the same vulnerability management rigor as the CMS core itself. Automated dependency scanning, timely patch deployment, and continuous monitoring of storefront activity are no longer optional for organizations that process transactions online.

Drupal site operators should consult the official advisory for the definitive list of affected versions and patched releases, and should monitor for follow-up guidance as the investigation into active exploitation continues.

Original source: The Hacker News