{
  "id": 17720261,
  "title": "Drupal Warns of Critical Commerce Core Flaw Exploited",
  "url": "https://urgent.news/2026/11/02/drupal-warns-of-critical-commerce-core-flaw-exploited",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-02T01:30:44.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/buyexamvouchers/drupal-warns-of-critical-commerce-core-flaw-exploited-200"
  },
  "original_language": "en",
  "account": "Drupal has issued a critical advisory warning administrators about a severe security flaw in the Commerce Core module. BleepingComputer reports that unauthenticated attackers can exploit the vulnerability, which lies in the module's insufficient protection of certain routes and entity fields. This allows attackers to bypass authorization checks and potentially tamper with orders, leading to financial losses for vendors. The flaw is already being actively exploited in the wild. Drupal urges administrators to patch the issue immediately and thoroughly audit their orders for inconsistencies. The Commerce Core module, used by more than 42,000 websites, including Fortune 500 companies, should be treated as in scope until its version is confirmed. The advisory advises backing up databases, checking the Commerce version, updating the module, and running database updates. After updating, clear caches and test the checkout process. Administrators are encouraged to look for suspicious write requests in web server logs and audit orders for tampering.",
  "summary": "Drupal has told admins to patch CVE-2026-118539 in the Commerce Core module right away, because attackers are already exploiting it. The flaw is a missing authorization weakness that unauthenticated attackers can abuse, according to BleepingComputer's report . If you run a Drupal store, update the module first. Then check your orders for signs of tampering. What happened Drupal's security team…",
  "key_points": [
    "Drupal issues critical advisory on Commerce Core security flaw",
    "Attackers can exploit vulnerability without authentication",
    "Module used by over 42,000 websites including Fortune 500 firms"
  ],
  "editors_take": "Active exploitation of this authorization bypass forces large-scale e-commerce vendors to prioritize immediate patching and order auditing to prevent direct financial losses from unauthenticated attackers.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}