Drupal warns Commerce Core access bypass is being exploited in the wild

Drupal is urging online store owners to patch a highly critical access bypass in the Commerce Core module, saying the flaw is being exploited in the wild. SecurityWeek reported the warning on October 30.

Commerce Core is a contributed module that adds e-commerce features to Drupal sites, including a shopping cart and checkout. Drupal's statistics show it runs on more than 42,000 sites.

In its advisory, Drupal says the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor." The security team rated the issue 21 out of 25 on its risk scale, a score that indicates unauthenticated attackers can exploit it regardless of how the module is configured.

Drupal confirmed the attacks but hasn't said how the bug is being exploited, who is behind them, or how many sites were hit. It also hasn't said whether the flaw was used as a zero-day before fixes were available.

Administrators are told to update to one of the two fixed releases and to review store orders. "Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited," the advisory reads.

The disclosure came alongside 38 other Drupal advisories published the same day, covering 21 contributed projects. Nearly a dozen were rated critical, including bugs that could lead to remote code execution, account takeover, or Commerce orders paid through Stripe being marked as paid without payment.

What defenders should do

• Identify whether Commerce Core is installed and which release line you run, then move to a fixed version.
• Review recent orders for inconsistencies, as the vendor advises.
• Treat the other advisories from the same batch as part of the same patching window, especially the critical ones.
• Watch for follow-up guidance from Drupal on exploitation details.

CVE references

CVE-2026-118539