Drupal Commerce flaw exploited against online stores; patch urged now
By Karan BansalTech Startups Correspondent, Peepals Tech
Representative image: axbenabdellah / Pixabay
Drupal warned on 28 October 2026 that a highly critical access flaw in its Commerce Core module, used by over 42,000 sites, is being exploited; store owners should update and audit orders.
What Happened
The Drupal project warned on Wednesday, 28 October 2026 that a security flaw in Commerce Core, a widely used add-on for building online shops on the Drupal website platform, is being actively exploited by attackers. The flaw, tracked as CVE-2026-118539, is a missing authorisation check: the software fails to confirm that a person is allowed to do something before letting them do it. Drupal rated it "highly critical" and said it can be exploited without logging in. Site owners are being told to update immediately and to check their orders for anything unusual.
Key Facts
- Flaw: CVE-2026-118539, a missing-authorisation (access bypass) weakness in Drupal Commerce Core.
- Advisory: Drupal security advisory SA-CONTRIB-2026-254, published on 28 October 2026.
- Severity: rated "highly critical" by Drupal, 21 out of 25 on its own risk scale.
- Exploitation: Drupal says the vulnerability is being exploited in the wild and does not require the attacker to be logged in; it has not published details of the attacks.
- Scale: the module is used on more than 42,000 websites, according to security reporting.
- Fix: update Commerce Core to version 3.3.13 or, on older branches, 8.x-2.41, the releases named in the advisory, and audit orders for inconsistencies.
- At the time of reporting, the flaw had not been added to the US cyber-security agency CISA's Known Exploited Vulnerabilities list.
Why It Matters
Drupal is free, open-source software that runs many websites, from government portals to online shops. Commerce Core is the module that turns a Drupal site into a store, handling products, carts and orders. An authorisation flaw in such a module is serious because it can let an outsider do things that only an administrator or the account owner should be able to do. Drupal's advice to "audit orders" suggests the risk involves the integrity of orders, which for a shop means money, stock and customer trust.
The phrase "actively exploited" is the key part of the warning. Many security bugs are found and fixed before anyone abuses them. When a project says a flaw is already being used in attacks, every unpatched site is a possible target, and the time to act is measured in hours or days, not weeks.
For Indian start-ups and small businesses, the lesson is wider than Drupal. Many young companies build their first online store on open-source tools and add-ons and then do not update them regularly. A store that is built quickly but left unpatched can become the weak point through which customers' data or orders are exposed. Data-protection rules in India also place responsibility on businesses to keep the personal data they hold safe, so a known, unpatched flaw can carry legal as well as business risk.
| What to check | Action |
|---|---|
| Do you run Drupal with Commerce Core? | Check the installed version now |
| Version older than the fixed releases? | Update to 3.3.13 or 8.x-2.41 |
| Recent orders | Look for changes or orders you cannot explain |
| Hosting provider or agency | Ask them to confirm the update is done |
Impact
Short-term: Online shops running vulnerable versions face attacks until they install the update. Developers and agencies that maintain Drupal stores are likely to be busy patching client sites.
Long-term: The incident adds to pressure on businesses to treat software updates as routine maintenance and to monitor security advisories for every add-on they use, not only the main platform.
Who is affected: Owners of Drupal-based online stores, their customers, web development agencies and hosting providers, and security teams.
Key Takeaway
Drupal says a highly critical Commerce Core flaw, CVE-2026-118539, is being exploited, so every Drupal store should update to 3.3.13 or 8.x-2.41 and audit its orders now.
Questions and Answers
What is the Drupal Commerce vulnerability CVE-2026-118539?
It is a missing-authorisation flaw in Drupal Commerce Core, the add-on used to run online shops on Drupal. Drupal rated it highly critical on 28 October 2026 and said it can be exploited without logging in.
Is the Drupal Commerce flaw being used in attacks?
Yes. Drupal's advisory says the vulnerability is being actively exploited in the wild, although it has not shared details of the attacks.
What should Drupal store owners do?
Update Commerce Core to 3.3.13 or, on older branches, 8.x-2.41, as named in Drupal's advisory, and check recent orders for any inconsistencies. Businesses that use an agency or host should ask them to confirm the update.
Does this affect ordinary online shoppers?
Shoppers cannot fix the flaw themselves. It is the responsibility of the store owner to update. Customers can protect themselves by checking their order history and bank statements for anything they do not recognise.
Disclaimer: Prepared by the Peepals newsroom from publicly available sources with AI assistance. Information is accurate to the best of our knowledge at the time of publication and may change. Images may be representative. Not professional advice. Report an error via our contact page.
By Karan Bansal, Tech Startups CorrespondentCovers Tech Start-ups & Stories and more for Peepals Tech. All stories by Karan Bansal
Oracle share price rises as Google's TPU AI chips come to Oracle Cloud
Nvidia rejects report that Jensen Huang was target of Chinese spy plot
Get the day's stories in your inbox
Peepals Weekly: the week decoded, free. One email a week, unsubscribe in one click.
Karan Bansal is a pen name of the Peepals Global Editorial Team, which researches, fact-checks and publishes every story. The portrait is an illustration.
