Attackers walk straight through Drupal's checkout

Drupal is telling administrators to patch Commerce Core because attackers are already exploiting it. CVE-2026-118539 is a missing authorization flaw in the module that runs shopping carts and checkout for more than 42,000 sites, including Fortune 500 companies and research universities. Drupal rates it highly critical and says it is being exploited in the wild, though the advisory gives no detail about who is doing it or what they are taking.

The mechanism, in Drupal’s words: the module “doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.” Commerce Core exposes a shopping cart, a checkout form, and APIs for decoupled front ends. Routes and entity fields that should sit behind an authorization check are reachable without one, and BleepingComputer reports the bypass works for unauthenticated attackers.

Affected versions run from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13. If you are on the 3.x branch, upgrade to 3.3.13. On anything earlier, the fix ships as 8.x-2.41.

The patch is only half the job. Drupal’s security team is also telling admins to audit orders for inconsistencies, since the vulnerability is already being exploited. The advisory gives no detail about the activity, so there is no published indicator to match against; the audit is working from the fact that this is a missing-authorization flaw that may financially impact the vendor. Pull the orders created during the exposure window and check them for inconsistencies.

The flaw was reported by Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd). The CVSS score is listed as N/A, so Drupal’s “highly critical” tag is the only severity signal on offer.

This lands in a rough stretch for Drupal. In May, Drupal warned of an SQL injection flaw in the database abstraction API (CVE-2026-9082) that could lead to privilege escalation, information disclosure, and remote code execution; CISA added it to the KEV catalog within days and gave federal agencies three days to patch. Two weeks ago Drupal patched two remote code execution issues (CVE-2026-108097 and CVE-2026-108099) and warned that attackers could build working exploits “within hours or days.” Over the last several years CISA has flagged five Drupal vulnerabilities as exploited in the wild, two of them picked up by ransomware crews.

Unlike that two-week-old RCE pair, where Drupal was warning about exploits attackers might build, this one is already in use. Upgrade to the fixed release, then reconcile every order from the exposure window against the payments you actually received.