The Drupal Security Team published advisory SA-CONTRIB-2026-254 on October 28, 2026, rating a flaw in the Commerce Core module highly critical and saying it is already being exploited. The bug, tracked as CVE-2026-118539, is an access bypass that attackers can use without logging in. If your online store runs on Drupal Commerce, patch it today.
What’s new
Drupal says Commerce Core doesn’t properly protect certain routes and entity fields, which lets an attacker get around access controls. The advisory scores the risk 21 out of 25: no login is needed, exploit code is in the wild, and every module configuration is affected. The fixed releases are 3.3.13 for the 3.x branch and 2.41 for the older 2.x branch.
BleepingComputer reported on October 30 that the module runs on more than 42,000 websites. Drupal hasn’t described how attackers are using the flaw. It does warn of possible financial harm to the store owner and asks site owners to audit their orders for inconsistencies.
Who it affects
Any site running Drupal Commerce Core below 2.41 on the 2.x branch, or from 3.0.0 up to (but not including) 3.3.13 on the 3.x branch. That includes stores selling products, subscriptions, tickets or donations through Commerce. WordPress, WooCommerce and Shopify stores aren’t covered by this advisory.
Agencies and freelancers who look after Drupal sites for clients should check every install, including staging copies that anyone can reach from the internet.
Our take
We’d treat this as a same-day job. Update the drupal/commerce package to 3.3.13 (or 2.41) with Composer, clear caches, and confirm the new version on the Available updates report. Then compare the last few weeks of orders against your payment gateway and look for odd totals, changed statuses or customers you don’t recognize. If something looks wrong, put the store into maintenance mode and keep your logs before changing anything else.
If you need help patching or watching for trouble afterward, our website maintenance team handles updates and security checks, and our ecommerce development team can review your store setup. For a similar case from earlier this month, read our brief on the Magento and Adobe Commerce flaw.
