Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk.

Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.

Angreifer missbrauchen Lücken in veralteten Betriebssystemen oder als Zero-Day-Lücken in Drupal, Ivanti Connect Secure und Synology.

  Drupal has confirmed active exploitation of a highly critical access bypass vulnerability in its Commerce Core module, warning online retailers that attackers could manipulate orders and circumvent payment processes. The company has urged administrators to install the latest security updates and investigate existing transactions for unauthorized modifications. Tracked as CVE-2026-118539, the vulnerability affects Drupal Commerce Core, a contributed module that enables websites to sell products and services through shopping carts, checkout systems and payment integrations. It also supports headless commerce architectures, where external applications interact with Drupal through APIs. According to the original security advisory, certain application routes and entity fields do not have sufficient access restrictions, allowing unauthorized users to bypass established permission checks. This could enable attackers to manipulate commerce-related information, potentially causing direct financial losses for merchants. Published on October 28 under advisory SA-CONTRIB-2026-254, the vulnerability received a Drupal security risk score of 21 out of 25, placing it in the highly critical category. Its assessment identifies the flaw as exploitable without authentication or special access requirements, regardless of the module's configuration. Drupal has confirmed that the vulnerability is being actively exploited in the wild. However, its initial advisory did not disclose the attack methodology, affected organizations or the number of compromised websites. Fraudulent Order Attempts Reported on Live Websites Additional information published on October 29 by Centarro, the maintainer of Drupal Commerce, provides further insight into the exploitation activity. According to Centarro, it received two reports from merchants who observed suspicious attempts to place fraudulent orders on their live websites. Following an investigation conducted alongside the Drupal Security Team, the maintainers stated that they had not found evidence of scripted or widespread exploitation beyond the initially reported sites. The vulnerability affects both traditional, full-stack Drupal Commerce installations and headless deployments, although the potential attack paths differ depending on the website's architecture. Centarro identified several suspicious transaction patterns that administrators should investigate. These include orders placed without corresponding payments, transactions marked as paid despite having no associated payment records, product prices modified without legitimate promotions, and unauthorized discounts, fees or other adjustments applied to orders. Some reported attempts involved products listed at unusually low prices, including $0.01, while others used apparently normal prices to make fraudulent transactions less conspicuous. The maintainers also warned that the vulnerability may have existed in earlier Commerce Core releases for several years. Exploitation was theoretically possible from version 8.x-2.18, released in May 2020, on installations using Drupal's JSON:API module. Other configurations became potentially vulnerable from version 8.x-2.25, released in June 2021. Consequently, organizations should not restrict their investigation to transactions created shortly before the October security disclosure. Security Updates and Additional Commerce Vulnerabilities Drupal has released Commerce Core 3.3.13 and 8.x-2.41 to address CVE-2026-118539. Administrators running the 3.x branch should upgrade to version 3.3.13, while installations using the earlier 8.x-2.x branch should move to 8.x-2.41. Centarro has also recommended updating the associated Commerce API, Commerce License, Commerce Shipping and Commerce Stripe modules, which received separate security releases. Websites that do not require write operations through JSON:API should consider restricting the interface to read-only access. The October 28 security releases addressed several additional vulnerabilities across Drupal's contributed projects. Among them, CVE-2026-118558 affects Commerce Stripe through a cross-site request forgery (CSRF) vulnerability. The module does not include a CSRF token in the return URI used during Stripe Connect authorization. An attacker could exploit this weakness by tricking an administrator into following a malicious link, potentially causing an order to be marked as paid without an actual payment. Another issue, CVE-2026-118582, affects the CAPTCHA module. The vulnerability results from inadequate invalidation of previously solved CAPTCHA sessions, allowing an already-submitted protected form to be submitted again without completing another challenge. This could weaken protections against automated registrations, comment spam and login brute-force attempts. Drupal's advisory indicates that exploit code exists, although it does not confirm active exploitation. Drupal also disclosed information disclosure vulnerabilities in Commerce Core and Media Alias Display. The former can expose information about unpublished product variations under certain JSON:API configurations, while the latter involves improperly configured caching that could expose files containing information intended to remain inaccessible. Earlier Critical Drupal Vulnerabilities The October disclosures follow another security release on October 14, when Drupal addressed two critical remote code execution vulnerabilities. CVE-2026-108097 affects the Field UI module in Drupal Core, while CVE-2026-108099 impacts the contributed Entity List module. Although neither component independently exposes the vulnerabilities through its default functionality, certain contributed modules and custom implementations can introduce exploitable pathways. Drupal identified at least one potential attack path that does not require authentication. Another vulnerability, CVE-2026-9082, involved SQL injection in Drupal Core's database abstraction API, affecting websites using PostgreSQL databases. The flaw could allow unauthenticated attackers to execute specially crafted database queries, potentially resulting in information disclosure, privilege escalation or remote code execution. The vulnerability was added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog in May 2026 following confirmed exploitation. With CVE-2026-118539 now confirmed under active exploitation, administrators should prioritize security updates, examine historical order records and verify that payment confirmations correspond to actual transactions before fulfilling orders. Centarro has also recommended comparing suspicious transactions against website access logs to establish whether they originated through legitimate checkout processes.

Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.

The Drupal AI Initiative is a coordinated, strategic program that launched in June 2025 to drive the vision, development, and integration of artificial intelligence in the Drupal ecosystem. It is

Drupal has warned that hackers are actively exploiting a highly critical security flaw in Commerce Core , putting online stores at risk of financial losses. Tracked as CVE-2026-118539, the vulnerability lets attackers bypass access checks in the module used to sell products and services on Drupal websites and connected shopping applications. The warning raises concerns about unauthorized changes to store data and transactions. However, Drupal has not confirmed that attackers can buy products for exactly $0.01. The public advisory does not document that price, describes a potential financial impact, and does not name the fields attackers can change or explain how observed attacks worked. Published on October 28, 2026, the official Drupal security advisory identifies insufficient protection around certain routes and entity fields. Routes handle requests to website functions, while entity fields hold data associated with site records. Missing access checks can let someone reach functions or data they should not control. Critical Drupal Commerce Vulnerability Drupal assigned the flaw a risk score of 21 out of 25, placing it in its “Highly critical” category. This is Drupal’s own security scale, not a CVSS score. The assessment indicates that exploitation requires no authentication and affects all configurations of vulnerable module versions. The rating also identifies possible exposure of some private information and changes to some data. Drupal has confirmed active exploitation but has not published affected store names, attack volumes, or a detailed attack method. The advisory does not establish remote code execution or full website takeover. Commerce Core supports shopping carts, checkout forms, and separate applications connected through APIs. Its project page reports more than 42,000 websites using the module. That figure reflects reported installations, not the number of stores confirmed vulnerable or compromised. The vulnerability affects Commerce Core versions before 2.41 and versions from 3.0.0 up to, but not including, 3.3.13. Administrators running the 3.x branch should install Commerce Core 3.3.13. Sites using earlier versions should upgrade to Commerce Core 8.x-2.41, following Drupal’s published guidance. These are Commerce module updates, separate from Drupal core security releases. Earlier coverage of a critical Drupal remote code execution vulnerability concerns a different flaw. Store owners should check the installed Commerce package rather than assume a recent Drupal core update fixed this issue. Drupal explicitly advises affected sites to audit orders for inconsistencies because exploitation is already underway. Beyond applying the update, a practical review should compare recorded orders with expected prices and payment records, investigating unexplained differences rather than treating them as proof of compromise. This threat differs from Magecart attacks that target online checkout pages and steal customer payment details. Here, Drupal’s warning centers on broken access controls and possible merchant losses. Researchers Dan Puccetti, Marcus Johansson, and Robert Snyder reported the vulnerability. Prompt patching and order checks remain the immediate priorities for affected online stores. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Critical Drupal Commerce Vulnerability Could Let Hackers Buy Products for Just $0.01 appeared first on Cyber Security News .