Skip to contentistheinternetok
All incidents

Security flaw·Major

Drupal online shops: exploited flaw lets attackers tamper with orders

Fix availableAttackers already use itAffects website owners
Drupal Commerce Core

What it changes for you

Nothing visible for you; shop owners must update.

A flaw in Commerce Core, the module that powers online shops built on Drupal, lets anyone without an account reach parts of a shop they should not. Drupal says attackers already use it. A fix is out.

Started Oct 28, 2026Updated Oct 28, 2026

Post on X

What should I do?

You
Nothing to do.
If you run a website or an app
Update Commerce Core to 3.3.13 (3.x) or 8.x-2.41 (older versions) now, then audit your orders for inconsistencies.

What is affected

CVE-2026-118539

Timeline

  1. Fix available · Oct 28, 2026

    Drupal publishes SA-CONTRIB-2026-254, rated highly critical, with fixed versions 3.3.13 and 8.x-2.41, and says the flaw is being exploited in the wild.

    Drupal

Sources