Every online store has a cash register, and most days it does exactly what it should. This week the Drupal Security Team warned that on some Drupal Commerce sites, people who were never invited have been reaching into the till, and it's happening in the wild right now.

A Highly Critical Hole in the Checkout

On October 28, the Drupal Security Team published SA-CONTRIB-2026-254 for Commerce Core, tracked as CVE-2026-118539. It's a missing-authorization flaw that unauthenticated attackers can abuse. In the advisory's words, the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor." Drupal rates it Highly Critical, 21 out of 25 on its own risk scale, and confirms it is being actively exploited.

The fix is Commerce Core 3.3.13 for the 3.x branch, or 8.x-2.41 for sites on the older line. Drupal is also asking admins to audit their orders for inconsistencies, which tells you the attacks may already have left marks. According to its project page, Commerce Core runs on more than 42,000 websites.

"May Financially Impact the Vendor" Is Doing Heavy Lifting

Drupal hasn't said which fields attackers are tampering with or how the observed attacks work, which is sensible while thousands of stores are still unpatched. Some headlines have already jumped to dramatic one-cent shopping spree scenarios, but the advisory doesn't confirm any specific price trick. What it does confirm is bad enough: someone who isn't logged in can reach parts of the store they shouldn't, and the merchant is the one who pays for it.

The step people tend to skip is the order audit. Patching closes the door, but it can't tell you who walked through it last week. Look for odd totals, strange adjustments, and orders that don't line up with payments you actually received. This advisory also caps a very busy October for Drupal security, following the Block AJAX, core Field UI and Ffmpeg Image Toolkit advisories, so stores that patch "when we get around to it" are in a rough spot.

Upgrade to 3.3.13 or 8.x-2.41 today, then reconcile your orders against your payment records. An unpatched store is still taking orders, but you're no longer the only one deciding what goes through.

If your Drupal Commerce store needs a fast upgrade and a second set of eyes on those order logs, our team can help you patch and audit this week.

Source: BleepingComputer