Drupal Commerce access bypass exploited in the wild (CVE-2026-118539)
Original title: Critical Drupal Commerce Vulnerability Could Let Hackers Buy Products for Just $0.01
Unauthenticated attackers can reach protected routes and fields; sites should update and audit orders.
Drupal says attackers are exploiting insufficient access checks in Commerce Core, tracked as CVE-2026-118539. The flaw needs no authentication, affects all configurations of vulnerable versions, and can expose some private information or change some data. It does not, by the advisory, enable remote code execution or full site takeover. Commerce Core before 2.41 and from 3.0.0 up to but not including 3.3.13 is affected. Drupal urges updates and order audits because exploitation is underway.
Unconfirmed: Drupal has not confirmed that attackers can buy products for $0.01, and it has not named affected stores or attack volumes.
- Drupal rated the issue 21 out of 25, highly critical on its own scale.
- Fixed releases are Commerce Core 8.x-2.41 and 3.3.13.
- The project page reports more than 42,000 sites using the module.
- The advisory was published on October 28, 2026.
- Dan Puccetti, Marcus Johansson, and Robert Snyder reported the flaw.
Impact: Unauthenticated changes to store data and transactions
| Product | Affected | Fixed in |
|---|---|---|
| Drupal Commerce Core | before 2.41, and 3.0.0 up to but not including 3.3.13 | 8.x-2.41 and 3.3.13 |
- 1.Upgrade 3.x sites to Commerce Core 3.3.13, or earlier branches to 8.x-2.41.
- 2.Audit orders for inconsistencies against expected prices and payment records.
- CVEs
- CVE-2026-118539
- Vendors
- Drupal
- Products
- Commerce Core
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118539 | Missing authorization in Drupal Commerce Core | 6.5 | — |
From the original article
2 min read at cybersecuritynews.com
Drupal has warned that hackers are actively exploiting a highly critical security flaw in Commerce Core, putting online stores at risk of financial losses. Tracked as CVE-2026-118539, the vulnerability lets attackers bypass access checks in the module used to sell products and services on Drupal websites and connected shopping applications. The warning raises concerns about […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.