There's a special kind of dread reserved for the phrase "actively exploited in the wild," and it hits harder when the thing being exploited is the part of your website that handles money. Drupal shop owners, this week's news is about you. Grab a coffee, and maybe your deployment credentials.
42,000 Stores, One Unlocked Back Door
Drupal's security team has issued a "highly critical" advisory for Commerce Core, tracked as CVE-2026-118539. Per the advisory text quoted by BleepingComputer, the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor," and the team says it "is being actively exploited in the wild."
The weakness is classed as missing authorization, and BleepingComputer reports that unauthenticated attackers can abuse it. Commerce Core runs on more than 42,000 websites. The coverage points 3.x sites to Commerce Core 3.3.13 and older sites to 8.x-2.41. Check the official advisory for the exact patched release on your branch, and the team also tells admins to audit their orders for inconsistencies.
"Audit Your Orders" Is Doing a Lot of Work
Most security advisories end with "update and carry on." This one adds homework: go look at your orders, because something may already have happened to them. If attackers have been exploiting this, then "patch now" fixes tomorrow, but only an audit tells you what happened yesterday. Think of it as changing the locks and then checking whether anyone walked off with the silverware.
It's also part of a busy autumn for Drupal security. Two weeks earlier, Drupal patched two remote code execution flaws in core and warned that exploits could follow "within hours or days." In May, an SQL injection bug in the database abstraction API landed on CISA's Known Exploited Vulnerabilities list, and federal agencies got three days to patch it. None of that means Drupal is uniquely leaky. Drupal runs a lot of high-value sites, and high-value sites attract people with time on their hands and bad intentions. The good news is that the security team is disclosing quickly and loudly. The bad news is that disclosure doesn't patch anything until someone ships the update.
The angle most people miss is that e-commerce flaws rarely announce themselves. Nobody defaces your homepage. Instead you get odd discounts, orders in states that shouldn't exist, or fulfillment records that don't match payments. If your team checks the order log about as often as the gym membership, now's a good time to start.
Patch first, audit second, and pour one out for every "we'll update after the holiday rush" plan in the Drupal community.
If your Drupal Commerce store needs the patch, the order audit, and a second pair of eyes on what attackers may have touched, our team can jump in and handle it.
Source: BleepingComputer