Drupal Commerce flaw exploited to bypass online store controls

Drupal has warned online store operators that a highly critical access bypass in Commerce Core is being exploited in the wild. The flaw, tracked as CVE-2026-118539, affects a contributed module used to add e-commerce capabilities to Drupal sites, including shopping cart and checkout functions. Drupal states the module is deployed on more than 42,000 sites and that unauthenticated attackers can bypass access controls regardless of module configuration.

The Drupal security team assigned a risk score of 21 out of 25, and the advisory urges store owners to audit orders for inconsistencies, as exploitation is active.

Drupal confirms attacks but has not disclosed how the bug is being exploited, who is behind the activity, or how many sites have been targeted. The vulnerability affects 3.x versions before 3.3.13 and earlier 8.x-2.41, with administrators advised to update to one of the fixed versions.

In addition to Commerce Core, Drupal notes 38 other advisories published on 28 October addressing vulnerabilities in 21 contributed projects, including some rated critical for potential remote code execution, account takeover, or mis-marked Commerce orders via Stripe. Drupal also reports proofs of concept exist for two information‑disclosure bugs, one in Commerce Core and one in Media Alias Display.