Attackers are exploiting a flaw in Commerce Core, the Drupal module that runs shopping carts and checkout on more than 42,000 websites, BleepingComputer reported Friday. Organizations that sell online through Drupal, a widely used open-source content management system, need to patch and check their order records.
What Happened
Drupal's security team rated the flaw, CVE-2026-118539, "highly critical," 21 on its 25-point scale, in an advisory dated Oct. 28. The advisory says the vulnerability "is being actively exploited in the wild."
The module does not adequately protect certain routes and data fields, the advisory says, allowing an access bypass, in which someone reaches functions or data they should not be allowed to use. No login is needed. Drupal's risk rating says some non-public data can be exposed and some data can be changed, and the advisory warns the store operator could suffer financial harm. Neither Drupal nor BleepingComputer said who is behind the attacks or how many sites have been hit.
Fixed releases are available for both supported branches of the module. Drupal also urges site owners to audit their orders for inconsistencies.
Why It Matters
Commerce Core users include Fortune 500 companies and research universities, according to BleepingComputer. An unauthenticated flaw in the software that handles orders can touch revenue and customer records, not just a website's appearance. Order data altered before a patch stays altered afterward, which is why the audit step matters for finance and audit committees as well as IT teams.
The Cybersecurity and Infrastructure Security Agency (CISA) has listed five Drupal flaws as exploited over the years, two of them used by ransomware gangs, BleepingComputer reported.
The warning comes about two weeks after Drupal fixed two critical code-execution flaws in its core software. The Primary Wire reported, citing BleepingComputer, that Drupal said exploits could follow within days.
What to Watch
- Whether CISA adds the flaw to its catalog, which would set a federal patch deadline.
- Any details from Drupal or researchers on who is exploiting it and what attackers do with orders or payment data.
