Drupal Warns of Critical Commerce Core Flaw Exploited
Drupal has told admins to patch CVE-2026-118539 in the Commerce Core module right away, because attackers are already exploiting it. The flaw is a missing authorization weakness that unauthenticated attackers can abuse, according to BleepingComputer's report . If you run a Drupal store, update the module first. Then check your orders for signs of tampering. What happened Drupal's security team…
Drupal has issued a critical advisory warning administrators about a severe security flaw in the Commerce Core module. BleepingComputer reports that unauthenticated attackers can exploit the vulnerability, which lies in the module's insufficient protection of certain routes and entity fields. This allows attackers to bypass authorization checks and potentially tamper with orders, leading to financial losses for vendors.
The flaw is already being actively exploited in the wild. Drupal urges administrators to patch the issue immediately and thoroughly audit their orders for inconsistencies. The Commerce Core module, used by more than 42,000 websites, including Fortune 500 companies, should be treated as in scope until its version is confirmed. The advisory advises backing up databases, checking the Commerce version, updating the module, and running database updates.
After updating, clear caches and test the checkout process. Administrators are encouraged to look for suspicious write requests in web server logs and audit orders for tampering.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
