Drupal Commerce has an actively exploited security flaw. Check affected versions, install the fixes, and review orders and payments for inconsistencies.

TL;DR Drupal's security team has rated an access bypass in Commerce Core "Highly critical" and confirmed active attacks. The Drupal Commerce vulnerability, tracked as CVE-2026-118539, scores 21 out of 25 on Drupal's risk scale. According to advisory SA-CONTRIB-2026-254, "This vulnerability is being actively exploited in the wild." Commerce Core fails to protect certain routes and entity fields, which can cause financial losses for store owners.

TL;DR Drupal's security team has rated an access bypass in Commerce Core "Highly critical" and confirmed active attacks. The Drupal Commerce vulnerability, tracked as CVE-2026-118539, scores 21 out of 25 on Drupal's risk scale. According to advisory SA-CONTRIB-2026-254, "This vulnerability is being actively exploited in the wild." Commerce Core fails to protect certain routes and entity fields, which can cause financial losses for store owners.

YouTube video by WebWash

Repeated address entry and tracking updates add work after checkout. The release moves core MRW shipment tasks into the backend already used to manage orders.

One release keeps product changes inside the cart. The other addresses payment-reference handling for Drupal Commerce stores serving the Portuguese market.

Matt Robison’s Centarro post compares B2B and B2C eCommerce across sales cycles, pricing, payment, logistics and organisational account structures. The article argues that many businesses now need to support both consumer and business commerce from t...

Complex retail catalogues expose where e-commerce platforms must do more than display products. Open Imagination’s Hedonism Wines case study shows Drupal Commerce handling product modelling, EPOS synchronisation, international tax logic, warehouse al...

Recurring billing in Drupal no longer has a single obvious implementation path. Ryan Szrama’s Centarro analysis explains when Commerce Recurring gives organisations useful control over subscription data, carts, and custom workflows, and when gateway-...

A blog post by Ryan Szrama examines how failing Drupal Commerce projects are often attributed to the platform rather than poor development practices. It identifies common workflow and infrastructure gaps, including missing version control and staging...

A LinkedIn article explores how Drupal Commerce can be extended beyond retail use cases to support internal procurement within corporate intranets. The piece reframes core Commerce concepts around organisational workflows, budget controls and resourc...

Drupal Commerce 3.x continues to evolve with improvements to admin experience, checkout, and platform architecture. In a recent Talking Drupal episode, Ryan Szrama discusses what is changing now and how the project is positioning itself for the futur...

For B2B commerce, long‑term agility depends on more than feature checklists. Ryan Szrama argues that API extensibility—not flashy tools—is the foundation of scalable, future‑ready platforms. This principle is especially urgent in the age of AI.

Monarq has completed a full migration of the McGill Campus Store website from Drupal 7 to Drupal 11, rebuilding the platform for modern ecommerce. The project introduced shipment-based order processing, enhanced design, and improved content flexibili...

Centarro breaks down where Drupal Commerce excels—from small stores to complex, content-driven workflows—highlighting its strengths in integration, flexibility, and long-term scalability.