Drupal Commerce Core flaw is being exploited to place fraudulent orders
Drupal rated the Commerce Core access bypass 21 out of 25 on October 28th; Centarro tells merchants to upgrade to 3.3.13 or 8.x-2.41 and audit past orders.
By Ryan Merket · Published
Primary source: www.drupal.org
Why it matters
Commerce Core runs checkout on more than 42,000 reported Drupal sites, and the flaw targets the order itself: prices, adjustments and whether payment ever happened. Merchants need to check past orders as well as upgrade.
Drupal warned on October 28th that attackers are actively exploiting a highly critical access bypass flaw in Commerce Core, the module that adds shopping carts, checkout forms and sales APIs to Drupal sites. The advisory, SA-CONTRIB-2026-254, rates the flaw 21 out of 25 on Drupal's security scale and tracks it as CVE-2026-118539.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.