Drupal Commerce Vulnerability Exploited in Attacks Against Online Stores
Online retailers using Drupal Commerce are facing an active security threat as attackers exploit a vulnerability in the platform's core e-commerce functionality. The attacks highlight the risks associated with security weaknesses in applications that handle customer transactions, shopping carts, and order processing.
Drupal Commerce is an open-source e-commerce framework built on the Drupal content management system. It allows businesses to create customized online stores, manage product catalogs, process orders, and integrate payment and shipping services. Its flexibility makes it useful for complex commercial websites, but vulnerabilities in its core components can create significant risks when affected installations are exposed to the internet.
The reported exploitation is particularly concerning because e-commerce applications combine publicly accessible functionality with sensitive business operations. A weakness affecting how a store processes requests can potentially disrupt sales, compromise application integrity, or expose information, depending on the vulnerability's technical characteristics and the privileges available to an attacker.
For organizations operating Drupal Commerce websites, the incident reinforces the importance of applying security updates promptly and investigating suspicious activity rather than assuming that installing a patch automatically resolves a previous compromise.
Critical Drupal Commerce Vulnerability Exploited to Place Fraudulent Orders on Online Stores
A highly critical security vulnerability in Drupal Commerce is being actively exploited against online stores, allowing attackers to bypass access restrictions and potentially manipulate transactions without authorization. The flaw, tracked as CVE-2026-118539, affects the Commerce Core module used by more than 42,000 websites and has prompted an urgent warning from the Drupal Security Team and the framework's maintainers.
The vulnerability received a severity rating of 21 out of 25 under Drupal's security risk assessment system. It affects essential e-commerce functionality, including shopping carts, checkout operations, and order management. Unlike vulnerabilities that primarily expose information or disrupt website availability, this weakness can directly affect the financial integrity of online transactions, potentially allowing malicious customers to obtain products or services without paying the correct amount.
On October 28, 2026, Drupal released security updates addressing the vulnerability after receiving reports of suspicious activity on live commercial websites. Centarro, the company maintaining Drupal Commerce, subsequently confirmed that two merchants had reported attempts to place fraudulent orders using the flaw. Although investigators had not identified evidence of widespread automated exploitation at the time of the disclosure, the confirmed activity was sufficient for Drupal to classify the vulnerability as actively exploited.
The incident illustrates how weaknesses in application authorization can create substantial business risks without requiring attackers to take complete control of a website. By manipulating the information used to process orders, an attacker may be able to interfere with commercial transactions while leaving the rest of the application apparently operational.
CVE-2026-118539 Bypasses Critical Commerce Access Controls
CVE-2026-118539 is an access bypass vulnerability affecting the Commerce Core contributed module, which provides Drupal websites with functionality for selling products and services. The module supports conventional storefronts with integrated shopping carts and checkout pages, as well as headless commerce architectures that communicate with front-end applications through APIs.
According to Drupal's security advisory, the module does not adequately enforce authorization checks on certain application routes and entity fields. These weaknesses can allow unauthorized users to perform operations that should normally be restricted, creating opportunities to manipulate order information and interfere with payment-related workflows.
The Drupal Security Team classified the vulnerability as highly critical, assigning it a score of 21 out of 25. Its assessment indicates that exploitation does not require authentication and that affected configurations can be targeted without special prerequisites. The issue is particularly concerning because the vulnerable functionality is part of ordinary e-commerce operations, rather than an optional administrative feature that can simply be disabled.
The vulnerability affects Commerce Core 3.x releases earlier than version 3.3.13 and older 8.x-2.x releases earlier than version 8.x-2.41. Administrators are advised to upgrade to the appropriate corrected version immediately, even if their stores have not shown obvious signs of malicious activity.
The distinction between Drupal core and Commerce Core is important. Drupal Commerce is a contributed project installed on top of the Drupal content management system, meaning a website can be running an updated version of Drupal itself while still containing a vulnerable Commerce module. Security maintenance must therefore include both the underlying CMS and its installed extensions.
Merchants Report Fraudulent Orders and Manipulated Prices
The exploitation reports came directly from merchants who observed suspicious transactions on production websites. According to Centarro, the incidents were not discovered solely through theoretical vulnerability research or controlled penetration testing. Instead, store operators identified abnormal commercial activity that prompted an investigation into the underlying application behavior.
The reported attacks involved attempts to place fraudulent orders by manipulating information associated with the checkout process. Some orders contained clearly incorrect product prices, including amounts as low as $0.01, while others appeared to use normal prices. This variation makes the activity more difficult to identify through simple checks for unusually low transaction values.
Centarro outlined several potential indicators that merchants should investigate. These include orders marked as placed despite having outstanding balances, transactions appearing as paid without corresponding payment records, unexpected changes to product prices, and unauthorized discounts or adjustments affecting order totals.
One particularly concerning scenario involves an order that appears to have been paid in the store's order management system even though no corresponding payment was actually processed. If the merchant relies exclusively on the order status when preparing shipments or granting access to digital services, the attacker could potentially receive goods or services without completing a legitimate payment.
Another scenario involves manipulating the unit price of a product before completing checkout. A transaction may pass through the normal payment process, but the amount charged could be significantly lower than the legitimate price. Because a payment was technically completed, the order might not trigger basic fraud checks designed to detect unpaid purchases.
The reported activity demonstrates that fraudulent order manipulation does not necessarily require compromising an administrator account. An attacker exploiting weaknesses in authorization controls may be able to influence the data used by legitimate commercial workflows, producing transactions that appear valid unless their underlying records are examined carefully.
Both Traditional and Headless Drupal Commerce Stores Are Affected
Centarro confirmed that the vulnerability affects both traditional Drupal Commerce websites and headless implementations, although the exploitation paths differ depending on the application's architecture. Traditional storefronts typically manage product browsing, shopping carts, and checkout operations through Drupal-generated pages, while headless systems expose commerce functionality through APIs consumed by separate front-end applications.
The maintainers explained that the underlying weakness may have been exploitable for several years. In environments using Drupal's JSON module, the vulnerable behavior was theoretically possible as far back as Commerce Core 8.x-2.18, released in May 2020. For other configurations, the exposure dates back to Commerce Core 8.x-2.25, released in June 2021.
These historical details do not establish that attackers have been exploiting the vulnerability since those dates. Instead, they indicate how long the affected functionality may have existed before the security issue was identified and corrected. The confirmed reports concern the activity disclosed in October 2026.
The presence of JSON can create additional considerations because APIs may expose operations that are not directly available through a conventional storefront interface. When authorization checks are insufficient, requests submitted through these interfaces may allow attackers to interact with order data in ways that bypass expected business rules.
Centarro recommends disabling unnecessary write operations through JSON where they are not required by the application. For stores that only need API access to retrieve information, switching the interface to read-only mode can reduce the number of operations available to unauthorized users.
However, configuration changes should not be treated as a substitute for installing the corrected Commerce Core release. Both traditional and headless installations require the security update, and merchants should review their transaction histories for suspicious activity that may have occurred before remediation.
Drupal Releases Security Fixes for Affected Commerce Versions
Drupal addressed CVE-2026-118539 through security advisory SA-CONTRIB-2026-254, published on October 28, 2026. The corrected releases are Commerce Core 3.3.13 for the 3.x branch and Commerce Core 8.x-2.41 for installations using the older release series.
The updates were developed and coordinated by Centarro and the Drupal Security Team following private investigation and testing. The maintainers emphasized that store operators should apply the fixes promptly because exploitation had already been observed on live websites.
Alongside the Commerce Core update, the maintainers released security corrections for several related projects, including Commerce API, Commerce License, Commerce Shipping, and Commerce Stripe. Organizations using these extensions should review their installed versions and apply the relevant updates as part of the same maintenance process.
Centarro also encouraged operators of older Commerce Core installations to plan migration to the 3.x branch. Continued reliance on legacy software can complicate future security maintenance, particularly when compatibility constraints prevent administrators from deploying newer versions quickly.
The October 28 security release was part of a broader set of Drupal advisories covering multiple contributed projects. In total, Drupal published 39 advisories addressing vulnerabilities across 21 projects, with several issues classified as critical.
Some of the additional vulnerabilities could potentially enable remote code execution, account compromise, or unauthorized manipulation of payment states. One particularly relevant issue involved Commerce Stripe functionality that could allow orders to be marked as paid without the corresponding payment being completed.
Although these vulnerabilities were disclosed during the same security release period, they should not be confused with CVE-2026-118539. Each issue has its own technical characteristics, affected components, and exploitation conditions.
Why Patching Alone Cannot Reverse Fraudulent Transactions
A central concern in the Drupal Commerce incident is that applying the security update prevents future exploitation of the identified weakness but does not automatically correct fraudulent transactions that may already exist in a store's database.
Unlike a vulnerability that simply causes a service to crash, transaction manipulation can leave persistent business records behind. An attacker may alter an order total, bypass payment requirements, or cause an order to appear completed, potentially allowing the fraudulent transaction to proceed through inventory, shipping, or fulfillment systems.
For this reason, Drupal and Centarro explicitly recommend auditing recent orders after applying the security update. Merchants should examine whether transactions were processed through legitimate checkout workflows and whether the recorded payment information matches actual financial activity.
The investigation should include comparisons between Drupal Commerce order records and the independent records maintained by payment processors. An order marked as paid within the application should correspond to a legitimate payment authorization or completed transaction, depending on the store's normal workflow.
Merchants should also investigate unexpected price overrides, discounts, fees, and other adjustments. A transaction with an unusually low amount may indicate manipulation, but suspicious activity can also involve orders with apparently normal prices. Reviewing how an order reached its final value is therefore more reliable than evaluating the amount alone.
Centarro has published SQL queries to help administrators identify potentially suspicious records, including orders placed outside the normal checkout process, discrepancies between recorded payments and order totals, overridden unit prices, and manually added adjustments.
These queries are intended to support investigation rather than provide definitive proof of exploitation. Legitimate administrative operations, custom checkout workflows, donations, and manually adjusted orders can produce similar database records. Findings should therefore be evaluated alongside access logs, payment processor information, and the store's expected business processes.
Financial Fraud Creates a Different E-Commerce Security Challenge
The Drupal Commerce vulnerability demonstrates how attackers can target the integrity of business transactions rather than focusing exclusively on stealing customer information or compromising servers.
Traditional web application security discussions frequently emphasize remote code execution, SQL injection, cross-site scripting, and credential theft. These threats remain important, but authorization weaknesses affecting commercial workflows can also produce substantial losses without generating the obvious indicators associated with a server intrusion.
For example, an attacker who can modify order prices or payment status may be able to exploit the store's own fulfillment procedures. If the application reports that an order has been successfully placed and paid, downstream systems may automatically begin shipping products, issuing licenses, or providing access to digital content.
The resulting loss can occur even when the website remains available, customer accounts are not compromised, and no malware is installed. This makes transaction integrity an important component of application security, particularly for businesses that depend on automated order processing.
Organizations should therefore evaluate whether their payment and fulfillment systems independently verify the conditions required to complete a transaction. A checkout confirmation should not be treated as sufficient proof of payment when the application itself may have been exposed to unauthorized manipulation.
Separating order placement, payment verification, and fulfillment authorization can reduce the consequences of these weaknesses. Independent reconciliation against payment provider records can also help identify discrepancies before fraudulent transactions result in irreversible financial losses.
Recommended Actions for Drupal Commerce Administrators
Organizations running Drupal Commerce should prioritize both technical remediation and transaction review. The confirmed exploitation activity means administrators cannot assume that an absence of obvious website errors indicates that their installations were unaffected.
The most important actions include:
Update Commerce Core immediately: Install version 3.3.13 or 8.x-2.41, depending on the branch currently deployed.
Review related Commerce modules: Apply available security updates for Commerce API, Commerce License, Commerce Shipping, and Commerce Stripe where applicable.
Audit recent transactions: Investigate orders with unusual prices, missing payment records, unexpected adjustments, or inconsistencies between order status and actual payment activity.
Verify payment independently: Compare application records with payment processor transactions before fulfilling suspicious orders.
Review checkout activity: Examine application and web server logs for orders created outside normal checkout workflows.
Restrict API permissions: Disable unnecessary write operations through JSON and other interfaces that expose commercial data.
Investigate price overrides: Identify transactions where product prices were manually changed without a legitimate administrative or promotional reason.
Strengthen fulfillment controls: Require verified payment information before shipping products or delivering paid services.
Administrators should also preserve relevant logs and transaction records if they discover suspicious activity. These records may be necessary to determine the scope of attempted fraud, identify affected orders, and support subsequent investigations.
For organizations operating multiple stores or complex integrations, the review should extend beyond the main Drupal Commerce interface. External order management systems, inventory platforms, payment gateways, and fulfillment services may contain additional evidence of transactions that were processed incorrectly.
A Broader Warning for Online Retailers
The exploitation of CVE-2026-118539 highlights a fundamental challenge in securing e-commerce applications: protecting the integrity of transactions is just as important as preventing unauthorized access to servers or customer information.
Drupal Commerce provides extensive customization capabilities, but that flexibility also requires careful management of authorization rules, API access, and integrations with external business systems. When a vulnerability affects core commercial functionality, the consequences can extend directly into revenue, inventory, and fulfillment operations.
The confirmed attacks appear limited based on the initial investigation by Centarro and the Drupal Security Team, which identified two reports of attempted fraudulent orders and did not initially find evidence of broader automated exploitation. However, the public disclosure and availability of security patches increase the importance of timely remediation, particularly for stores that remain on outdated versions.
The incident also reinforces the importance of maintaining visibility into business operations. A security team may detect unauthorized server access, but fraudulent order manipulation can remain unnoticed unless transaction records are regularly reconciled against independent payment and fulfillment information.
For Drupal Commerce operators, the immediate priority is to install the corrected versions and audit recent orders for inconsistencies. More broadly, the incident demonstrates that application security failures can cause direct financial harm even when attackers never obtain administrative credentials or full control of the underlying website.
As online commerce becomes increasingly automated, organizations must ensure that authorization controls, payment verification, and fulfillment processes remain independently trustworthy. Preventing fraudulent transactions requires not only secure software but also operational safeguards capable of detecting when apparently legitimate orders do not reflect genuine payments.