A Drupal store module lets strangers tamper with orders. Drupal says it's live.
By Lior AharonovFounder, 7IT Solutions ·
What happened
Drupal advisory sa-contrib-2026-254 covers CVE-2026-118539, an access bypass in the Commerce Core module scored 21 out of 25. Unauthenticated attackers can exploit it whatever the configuration, and Drupal has confirmed attacks in the wild. Fixes are 3.3.13 and 8.x-2.41.
Why it matters
Commerce Core runs the cart and checkout. If someone can reach order routes and fields without logging in, the numbers in your store may already differ from what customers paid.
What to do
If you run Drupal Commerce, update to 3.3.13 or 8.x-2.41 today, then audit your orders for inconsistencies, as Drupal advises.
My take
Lior Aharonov
Founder, 7IT Solutions
A patched checkout is half the job. The other half is checking what happened while it was open.
Sources
| SecurityWeek: Drupal Commerce Core Vulnerability Exploited Against Online Stores | securityweek.com |
Researched with AI tools; every fact is checked against the linked sources.