Introduction
Drupal has issued a critical security advisory regarding a vulnerability in the Commerce Core module, which has been exploited by attackers. This advisory highlights the importance of promptly applying security patches to mitigate the risk of exploitation. The Commerce Core module is a key component for e-commerce functionalities in Drupal, enabling the sale of goods and services through an integrated shopping cart and checkout form. This module is widely used, with over 42,000 websites utilizing it, including many high-profile organizations. The vulnerability, tracked as CVE-2026-118539, stems from a missing authorization weakness that can be exploited by unauthenticated attackers. The Drupal security team has advised administrators to upgrade to the latest version of Commerce Core, 3.3.13, or an earlier version, to mitigate the risk of exploitation. Additionally, administrators are advised to audit orders for inconsistencies, as threat actors are actively exploiting this vulnerability in attacks. ### Background on Commerce Core
Commerce Core is a community-developed Drupal module that provides a software framework for building and running e-commerce sites and shopping apps on top of the Drupal Content Management System (CMS). It is used by over 42,000 websites, including many high-profile organizations such as Fortune 500 companies and research universities. The module is critical for e-commerce functionalities, enabling the sale of goods and services through an integrated shopping cart and checkout form. ### Vulnerability Details
The vulnerability, CVE-2026-118539, is a critical access bypass vulnerability that can be exploited by unauthenticated attackers. It affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. The vulnerability stems from a missing authorization weakness, which can be abused to bypass certain routes and entity fields, leading to an access bypass that may financially impact the vendor. This vulnerability is being actively exploited in the wild. ### Recommendations for Administrators
Drupal security team advises administrators to upgrade to the latest version of Commerce Core, 3.3.13, or an earlier version, to mitigate the risk of exploitation. Administrators are also advised to audit orders for inconsistencies, as threat actors are actively exploiting this vulnerability in attacks. ### Historical Context
In May, Drupal also warned of an SQL injection vulnerability (CVE-2026-9082) in the database abstraction API that could lead to privilege escalation, information disclosure, and remote code execution. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to patch their systems within three days. Two weeks ago, Drupal patched two more remote code execution security issues (CVE-2026-108097 and CVE-2026-108099) that could allow threat actors to execute code remotely, and urged admins to apply updates as soon as possible because attackers could develop exploits
