Online retailers using Drupal Commerce are grappling with a severe security flaw that exposes their systems to potential exploitation. The vulnerability, tracked as CVE-2026-118539, permits attackers to bypass crucial access checks within the Commerce Core module, which facilitates online transactions on Drupal-based websites.
Understanding the Vulnerability
This critical flaw in Drupal Commerce has triggered alarms due to its capacity to allow unauthorized alterations in store data and transactions. Although Drupal has not verified claims that hackers can purchase products for as little as $0.01, the threat of financial repercussions looms large. The public advisory issued on October 28, 2026, outlines insufficient protections around certain routes and entity fields, which are vital to handling requests and managing data.
The flaw’s risk score, evaluated by Drupal as 21 out of 25, categorizes it as ‘Highly critical.’ This rating underscores the danger it poses, as it can be exploited without any authentication and affects all configurations of the vulnerable module versions.
Impact on Online Stores
Commerce Core, an integral component of over 42,000 websites, supports essential features like shopping carts and checkout forms. The flaw predominantly affects module versions before 2.41 and between 3.0.0 and 3.3.13. Administrators are urged to upgrade to Commerce Core 3.3.13 or 8.x-2.41 to mitigate the risks.
Drupal’s advisory, while confirming active exploitation, refrains from disclosing specific store names or attack methods. It emphasizes the need for store owners to audit order records for discrepancies, as immediate action is crucial to prevent potential losses.
Steps for Mitigation
To protect against this threat, Drupal advises a thorough review of order histories to spot inconsistencies. Patching the vulnerable versions is paramount, alongside conducting detailed audits to ensure order integrity. This approach is essential for uncovering any unexplained variations in order prices and payments.
Unlike Magecart attacks that primarily target customer payment details, this vulnerability highlights broken access controls that can result in merchant losses. Researchers Dan Puccetti, Marcus Johansson, and Robert Snyder were instrumental in identifying this flaw, prompting rapid response from affected retailers.
For online stores, staying vigilant against this threat is vital. Integrating threat intelligence and maintaining robust security protocols can aid in swiftly addressing incidents and safeguarding sensitive data.
