If your online store runs on Drupal Commerce, this is a same-day job. On 28 October 2026 the Drupal Security Team published advisory SA-CONTRIB-2026-254 for the Commerce Core module and said, in the advisory itself, that the vulnerability is being actively exploited in the wild. The advisory also asks site owners to do something unusual: audit their orders. This guide explains what is known, what to update to and how to check your store, using only what Drupal and the reports below have published.
For an online store, an access flaw in the order system is a revenue problem, not only a technical one. Photo: Rifki Kurniawan on Unsplash
The short answer
- What: an access bypass in Commerce Core, tracked as CVE-2026-118539 and advisory SA-CONTRIB-2026-254, rated highly critical.
- Who is affected: Commerce Core versions before 8.x-2.41, and 3.x versions from 3.0.0 up to but not including 3.3.13.
- Fix: upgrade to Commerce Core 3.3.13 on the 3.x branch, or 8.x-2.41 if you use an earlier version.
- Then: audit your orders for inconsistencies. Drupal says this is needed because the flaw is being exploited.
- Exploited: Drupal's advisory says so directly.
If you do nothing else today, schedule the update and start the order check in parallel.
What Drupal has said
According to the advisory, published on 28 October 2026, Commerce Core lets a store sell goods and services through a shopping cart and checkout form or through decoupled applications using APIs. The advisory says the module "doesn't sufficiently protect certain routes and entity fields", which leads to an access bypass that may financially impact the vendor.
The Drupal security team rates it 21 out of 25 on its risk scale, according to The Drop Times and SecurityOnline, which both describe it as the highest severity score in that day's batch. SecurityOnline adds that Drupal's risk string lists no authentication requirement and that all site configurations are affected, and notes that the project page shows about 42,000 sites reporting use of the module. The advisory does not publish technical detail, and we are not adding any here. It also does not name victims or quantify losses, as The Drop Times points out.
Why an order audit is part of the fix
Most patch advisories end with "update". This one adds that sites should audit their orders for inconsistencies, because the vulnerability is being actively exploited. That sentence matters. A patch closes the door, but it does not show whether someone has already walked through.
Because the advisory says the problem may financially impact the vendor, the sensible reading is that you should check anything that touches money: order totals, prices, discounts, payment status and fulfilment status. Drupal has not published a precise list of symptoms, so treat this as a reasonable approach, not an official checklist.
How to update safely
- Find your version. Check your Composer files or the Extend page in the admin area to see which Commerce Core release you run.
- Back up first. Take a full database and file backup before changing anything.
- Test on a copy. Apply the update on a staging copy of the store and walk through a test order: add to cart, checkout, payment, confirmation email and refund.
- Update production. Move to 3.3.13 on the 3.x branch or 8.x-2.41 on earlier versions, run database updates and clear caches as your process requires.
- Re-test checkout on the live site with a low-value order or your payment provider's test mode.
If you cannot update today, tell whoever owns the store that the risk is live and schedule the update as the first available task. Drupal's advisory names updating as the solution, and we have no source for a workaround.
How to audit your orders
Start from the day the vulnerable version was installed, or at least the last few weeks, and work in this order:
- Compare against your payment provider. Every order marked paid should match a real payment record. Export both lists and reconcile them.
- Sort by unusual values. Look for very low totals, zero-value orders, unexpected discounts or odd quantities.
- Check order states. Look for orders that moved to paid, completed or refunded without a matching event.
- Review recently changed orders. If your store keeps change logs, look for edits made outside normal staff activity.
- Check shipped goods. Compare dispatched items with paid orders, and pause shipments that do not reconcile.
- Record what you find. Keep a list so you can speak to your payment provider and your developer with specifics.
If you find anything odd, do not delete evidence. Preserve logs and tell your developer and payment provider. Our note on rotating secrets after a breach is a useful companion if you need to refresh credentials, and our website maintenance guide explains how to make updates routine.
Other Commerce advisories on the same day
The Drop Times reports that SA-CONTRIB-2026-254 was one of 39 contributed-project advisories published on 28 October 2026 across 21 projects, and that 12 of them concern Commerce Core, Commerce Stripe, Commerce Shipping and Commerce License. It says only the Commerce Core flaw is confirmed as actively exploited, and warns against treating the whole batch as equally exposed.
Among the others it describes: a critical Commerce Stripe issue affecting versions 2.0.0 through 2.2.2 and fixed in 2.2.3, in which an administrator could be tricked into following a crafted link that marks an order paid without payment. It also reports a Commerce License permissions issue fixed in 3.1.1 and separate Commerce Shipping fixes in 8.x-2.16 and 3.0.6, and says three projects, including PayUmoney for Drupal Commerce, were marked unsupported with advice to uninstall them. If your store uses any Commerce add-on, read the advisory list at drupal.org/security/contrib and match each module and version to your own.
If you are weighing platforms
An incident like this is a prompt to review how updates are handled, not necessarily to change platform. Any store running third-party modules needs a patch routine, whichever system it uses. Our comparison of Shopify and custom e-commerce covers how hosted and self-managed stores differ on maintenance, and our e-commerce development service covers security reviews and patching for custom stores.
Action checklist
- Identify whether your store uses Drupal Commerce and which Commerce Core version is installed.
- Take a full backup of the database and files.
- Update Commerce Core to 3.3.13 (3.x branch) or 8.x-2.41 (earlier versions), after testing on staging.
- Run a full test order through checkout, payment and refund after updating.
- Reconcile every recent paid order against your payment provider's records.
- Sort orders by unusual totals, discounts and state changes, and review each one.
- Pause shipping on any order that does not reconcile until it is checked.
- Check every Commerce add-on (Stripe, Shipping, License and others) against its advisory.
- Remove any module the Drupal team has marked unsupported, and plan a replacement.
- Keep logs and a written record of what you found.
Common mistakes to avoid
Patching and stopping. Drupal's own advisory asks for an order audit as well.
Skipping staging. A broken checkout costs sales too, so test the update first.
Updating only the core module. Commerce add-ons have their own advisories.
Trusting payment status inside the store alone. Reconcile against the payment provider's records.
Waiting for a technical write-up. Drupal has published no further detail, and the advisory already says the flaw is exploited.
Key takeaways
- CVE-2026-118539 is a highly critical access bypass in Drupal Commerce Core, and Drupal says it is being exploited.
- Update to 3.3.13 on the 3.x branch or 8.x-2.41 on earlier versions.
- Audit your orders against your payment provider's records, because patching does not undo earlier abuse.
- Check every Commerce add-on and remove unsupported modules.
- Build a routine for module updates, whatever platform your store uses.
Need help updating or reviewing a store? See our e-commerce development service or talk to our team.
Sources
- Drupal.org: Commerce Core, Highly critical, Access bypass, SA-CONTRIB-2026-254 (28 October 2026)
- Drupal.org: Security advisories for contributed projects
- SecurityOnline: Drupal Commerce Vulnerability CVE-2026-118539 Exploited in the Wild (29 October 2026)
- The Drop Times: Drupal Commerce Access Bypass Actively Exploited as Drupal Issues 39 Advisories (29 October 2026)
Last reviewed 30 October 2026. This article is general information, not a guarantee of protection. Advisories change, so confirm details on Drupal.org before acting.
