Yes, your Drupal site is vulnerable if it runs Commerce Core and you have not installed the fixed release. Commerce Core is the Drupal e-commerce module that runs carts, checkout, products and API sales.
The Drupal Security Team rated the flaw Highly critical 21/25 and tracks it as CVE-2026-118539 in its October 28 advisory. BleepingComputer reports the flaw is being actively exploited in the wild in its October 30 report. Unauthenticated visitors can abuse it without logging in.
Table of Contents
- Are You Running an Affected Version?
- How Do Attackers Exploit It?
- What Does Fraud Look Like?
- How Do You Fix and Audit Now?
Are You Running an Affected Version?
Drupal's release page lists affected branches as 0.0.0 through 2.41 and 3.0.0 through 3.3.12. Fixes are 8.x-2.41 and 3.3.13, released Oct. 28, 2026.
Check Extend, Composer, or your lock file for the installed commerce core version. Ostorlab analysis puts more than 42,000 sites in the at-risk group based on Drupal usage statistics in its lab analysis. The risk applies to any store with Commerce Core installed for carts, checkout and API sales. If Commerce is installed but unused, still treat it as exposed until patched.
How Do Attackers Exploit It?
Drupal describes the flaw as missing authorization, tracked as CWE-862. Commerce Core did not sufficiently protect certain routes and entity fields. That gap allows an access bypass with possible financial impact to vendors. Ostorlab reports attackers can manipulate orders through JSON:API or REST.
Examples include changing a cart's state, total_price, adjustments and unit_price. Attackers can also take over other vendors' variations, coupons and promotions. Commerce maintainer Centarro said it received two reports of malicious users attempting fraudulent orders with the flaw. Those attempts confirm real-world abuse against stores. Patching removes the open route, but it does not undo placed orders.
What Does Fraud Look Like?
Fraud from this flaw looks like an order problem, not a defacement. Totals, states and ownership change without a matching business event. Watch for these signs: Ostorlab notes NIST had not completed full analysis as of Oct.
30, showing only a secondary CVSS 3.1 score of 6.5 Medium. Drupal gave no actors, scale or compromise indicators in the packet. Use your own order and payment records as the check.
- paid status without payment records
- mismatched totals across cart, order and gateway
- coupons or promotions you did not create
- variations edited by an unexpected account
How Do You Fix and Audit Now?
Update Commerce Core to 3.3.13 if you run 3.x, or to 8.x-2.41 if you run 2.x. Apply the update on production without waiting for a maintenance window. Clear caches and confirm the new version is active.
SecurityWeek advises owners to upgrade immediately and audit recent orders in its security coverage. Paid status without payment records and mismatched totals are prime warning signs. Work through recent orders in age order:.
- hold fulfillment for suspicious orders
- compare order totals against gateway records
- review JSON:API and REST logs for cart edits
- re-save vendor permissions and rotate exposed keys
