Drupal is urging online store operators to update Commerce Core after warning that attackers are actively exploiting a highly critical access-bypass vulnerability in the e-commerce module.
Tracked as CVE-2026-118539, the flaw affects Commerce Core, a contributed module that adds shopping cart and checkout features to Drupal websites. The Drupal Security Team rates it 21 out of 25 on its own risk scale and says the module does not adequately protect certain routes and entity fields, creating a risk of financial harm to merchants. The advisory classifies the issue as highly critical and confirms that it is being exploited in the wild.
The vulnerability affects Commerce Core versions earlier than 2.41 in the 2.x branch and versions from 3.0.0 up to, but not including, 3.3.13 in the 3.x branch. Drupal has released Commerce Core 8.x-2.41 and 3.3.13 to address the problem. Store operators should install the appropriate fixed release and audit existing orders for inconsistencies, as the project specifically recommends.
Drupal published the security advisory on October 28. BleepingComputer reported the warning on Friday, noting that the vulnerability can be exploited without authentication. The issue is particularly relevant to businesses running an online store on Drupal, where access controls protect order and product information.
The Drupal Security Team says the flaw may financially impact vendors and advises administrators to review their orders after applying the update. The full technical details and fixed versions are listed in the official Commerce Core security advisory.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
