Drupal Commerce Core flaw exploited in the wild against online stores

· Cybersecurity

Drupal warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component, tracked as CVE-2026-118539. The bug is a missing authorization issue affecting Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Drupal is urging store owners to patch and to audit their orders, since an access bypass in an e-commerce module can expose order and customer data. The module underpins checkout and order management for many online stores built on Drupal, making the exploit a direct commercial risk rather than a theoretical one.

Why it matters：An actively exploited authorization bypass in a widely used e-commerce module puts payment and customer data at risk, underlining how third-party CMS components extend the attack surface.

Key points

  • Tracked as CVE-2026-118539, described as a missing authorization issue
  • Affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13
  • Store owners are urged to audit orders after patching

Sources (original reporting)

More stories from this day