Attackers are exploiting a critical access bypass in Drupal's Commerce Core module
The flaw, CVE-2026-118539, lets unauthenticated attackers reach unprotected routes and fields on stores built with a module used by more than 42,000 sites.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Drupal's security team has warned administrators to patch a highly critical access bypass in the Commerce Core module because attackers are exploiting it in the wild. The flaw, tracked as CVE-2026-118539, comes from missing authorization checks and can be abused by unauthenticated attackers. In its Wednesday advisory, Drupal said the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor." According to BleepingComputer, the affected releases span both the 2.x and 3.x branches. Drupal told administrators to upgrade right away and to check their orders for inconsistencies. Commerce Core is a community-built framework for running online stores and shopping apps on the Drupal content management system. It is used by more than 42,000 websites, including Fortune 500 companies and research universities. Because the bug can affect order handling, operators may face financial losses as well as security problems. That is why Drupal is asking them both to patch and to audit past orders for signs of tampering.