Every online store gets the occasional shopper who tries to leave without paying. This week Drupal confirmed that some of them showed up with an exploit. A highly critical flaw in Commerce Core is being used in live attacks, so if your store runs on Drupal Commerce, patch it today.

An Unlocked Back Door at 42,000 Stores

Drupal published an advisory warning of an access bypass in Commerce Core, the module behind more than 42,000 Drupal-powered storefronts, according to BleepingComputer. In Drupal's words, the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor." The bug, tracked as CVE-2026-118539, can be abused by unauthenticated attackers, and Drupal says it "is being actively exploited in the wild."

The fix is to update right away to the patched releases in Drupal's advisory. BleepingComputer cites Commerce Core 3.3.13 for the 3.x branch and 8.x-2.41 for older installs, though the reported version ranges are a little muddled, so confirm against the advisory itself. Drupal also tells store owners to audit their orders for inconsistencies, which is the security-team way of saying "check your receipts." Neither Drupal nor the coverage has said what attackers are doing once they get in.

Patching Is Step One, Not the Finish Line

"May financially impact the vendor" is about as polite as an advisory gets. In plain English, someone may have changed what your orders say, and the patch won't change them back. Updating closes the door. Only an order audit tells you whether anyone walked through it first, so compare prices, totals, and statuses against what your payment processor actually collected.

This isn't a one-off, either. Two weeks earlier, Drupal patched a pair of core flaws and warned that exploits could appear "within hours or days." CISA now lists five Drupal vulnerabilities as exploited in the wild, two of them by ransomware gangs. Attackers have figured out that Drupal sites run real businesses with real money attached, and "we'll get to it at the next maintenance window" has stopped being a plan.

Patch first, audit second, and keep watching your order history for the rest of the week.

If you'd like a second set of eyes on your Commerce update and order audit, our Drupal team can help you confirm the store is clean and keep it that way.

Source: BleepingComputer