Online store administrators using Drupal are being urged to address a serious security flaw in the Commerce Core module, a critical access bypass vulnerability identified as CVE-2026-118539. This vulnerability is actively being exploited and poses a significant risk to affected websites.
Understanding the Impact
The vulnerability affects the Commerce Core module, an essential plugin that integrates e-commerce functionalities into Drupal websites, such as shopping cart and checkout features. According to Drupal’s data, over 42,000 sites utilize this module. The flaw allows unauthorized access to certain routes and entity fields, potentially leading to financial losses for vendors.
The issue has been given a high-risk score of 21 out of 25 by the Drupal security team, highlighting its severity. Notably, the flaw can be exploited by unauthenticated attackers regardless of how the module is configured.
Response and Recommendations
While Drupal confirms active exploitation of this vulnerability, details on the methods of attack, responsible parties, or the number of targeted sites remain undisclosed. It is also unclear if the flaw was exploited as a zero-day vulnerability, prior to the availability of patches.
The affected versions include 3.x before 3.3.13 and earlier releases before 8.x-2.41. Administrators are advised to upgrade to the patched versions immediately and conduct thorough audits of store orders for any anomalies.
Broader Security Measures
On October 28, Drupal released 38 additional advisories, covering vulnerabilities in 21 contributed projects. Among these, nearly a dozen critical issues could result in remote code execution, account takeovers, or unauthorized Commerce orders through payment systems like Stripe.
Furthermore, a moderate bug in the CAPTCHA module, allowing form submission without solving a new challenge, was also addressed. Although exploit code exists for this bug, there is no evidence of active exploitation.
Conclusion and Future Outlook
Drupal’s proactive approach in addressing these vulnerabilities underscores the importance of timely updates in maintaining website security. As threats evolve, it is crucial for administrators to remain vigilant and implement recommended security measures promptly.
Looking ahead, it is vital that users stay informed about emerging threats and apply security patches swiftly to safeguard their digital assets.
