Drupal has released an emergency patch for an unauthenticated access-bypass flaw in Commerce Core. It is already being exploited in the wild and affects roughly 30,000 online stores.
Drupal has issued an emergency update for Commerce Core, the module that provides the cart, checkout and sales APIs behind thousands of online stores. The flaw, tracked as CVE-2026-118539, is rated 21 out of 25 — "highly critical" — on Drupal's own risk scale, and according to the advisory it is already being exploited in the wild.
What the flaw does
Commerce Core does not sufficiently protect certain routes and entity fields. The result is a straightforward missing-authorization problem: an attacker does not need to sign in, take over an account or hold any special privilege. An unauthenticated visitor can request pages and data they should never reach. Drupal states that some data can be read and some data can be modified, but has withheld which routes and fields are affected to avoid making exploitation easier.
In practice this can mean order records, customer details or price fields on a live store being viewed or altered by someone with no account at all. Drupal's post-patch guidance is telling: it advises merchants to audit their orders for unexpected prices, totals or status changes, which points to attacks that cause direct commercial loss rather than mere data exposure.
Who is affected
- Affected versions: all 2.x releases before 8.x-2.41, and all 3.x releases before 3.3.13.
- Fixed versions: 8.x-2.41 and 3.3.13, both available since 28 October 2026. They also close five lower-severity issues.
- Scale: as of 18 October, 42,002 sites reported using Commerce Core — 13,028 on the 2.x branch and 17,019 on 3.x. That puts roughly 30,000 stores in the directly affected range.
- Out of scope: the 1.x releases running on Drupal 7 are not covered by this advisory. Drupal 7 has received no security updates since January 2025, so those sites already carry a larger risk.
Why this matters for smaller businesses
A great many company websites and web shops were built by an agency years ago and have received nothing but content edits since. Who watches the module updates is usually nobody's clearly assigned job. But this is not only a website problem: unauthorised access to order and customer records is a personal data breach, and in Turkey, under Law No. 6698, the data controller has 72 hours from becoming aware of it to notify the Authority.
What Kamer Bilişim recommends
- Check your version today and apply the patch. Move to 3.3.13 on the 3.x branch, or 8.x-2.41 on 2.x. With a flaw under active exploitation, waiting for the next maintenance window is not a decision that can be deferred.
- Run a backward-looking order audit after patching. A patch only protects you from now on. Review recent orders for unexpected prices, discounts, totals or status changes, and check your web server access logs for unusual requests.
- Bring the site into a maintenance agreement. Define in writing who owns the CMS core, the modules, the PHP version and the backups. If it is unclear whose job updates are, in practice they are nobody's job.
If you would like us to review how up to date your company website is — on Drupal, WordPress or any other platform — we work on site across the Anatolian side of Istanbul and remotely. You can reach us through our contact page.
Source: Drupal security advisory (SA-CONTRIB-2026-254) and ITdaily, 30 October 2026
Source: ITdaily