Security notice
Online store on Drupal Commerce? Drupal says a flaw is being exploited. Update and check your orders.
On October 28, 2026, the Drupal security team published advisory SA-CONTRIB-2026-254 for Commerce Core, the module that adds a shopping cart and checkout to Drupal websites, and said the flaw "is being actively exploited in the wild." The flaw, CVE-2026-118539, is an access bypass. Drupal says the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor," and rates it highly critical, 21 out of 25. Drupal's list of affected versions is Commerce Core 8.x-2.x before 8.x-2.41 and 3.x before 3.3.13, and its advice to store owners is: "Sites should audit their orders for inconsistencies." Drupal has not said how the flaw is being exploited or how many sites were hit. If your store runs Drupal Commerce, update to 3.3.13 (3.x) or 8.x-2.41 (older sites) today, then check your recent orders against your payment records.
What happened
- What Drupal says. The Drupal security team published SA-CONTRIB-2026-254 on October 28, 2026, titled "Commerce Core - Highly critical - Access bypass." Its description reads: "The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. This vulnerability is being actively exploited in the wild." We read "vendor" as the store owner. Drupal does not say what an attacker can do beyond that, so we cannot say whether it changes prices, marks orders as paid or does something else. (Drupal advisory)
- Who can use it. Drupal scores the flaw 21 out of 25, highly critical, with the code AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All. In Drupal's own guide, A:None means anonymous visitors can exploit it, E:Exploit means an exploit exists in the wild, and TD:All means all configurations of the module are affected. CI:Some and II:Some mean some non-public data may be released and some data may be changed. SecurityWeek reads the score the same way: "unauthenticated attackers can exploit the flaw no matter how the module is set up." Drupal's guide supports that reading. (Drupal advisory, Drupal risk levels guide, SecurityWeek)
- Affected and fixed versions. Drupal lists the affected versions as "<2.41 || >=3.0.0 <3.3.13." In plain terms: Commerce Core 3.x before 3.3.13, and the older 8.x-2.x line before 8.x-2.41. Drupal says 3.x users should upgrade to Commerce Core 3.3.13, and users of earlier versions to Commerce Core 8.x-2.41. Both releases are dated October 28, 2026. (Drupal advisory, Drupal project page)
- Exploited, with few details. Drupal confirms attacks but, according to SecurityWeek, has not said how the bug is being exploited, who is behind it, how many sites were targeted, or whether it was used before the fix was out. We found nothing from Drupal that answers those questions. (Drupal advisory, SecurityWeek)
- Not on CISA's list yet. CISA KEV does not list CVE-2026-118539 in its catalog version dated October 29, 2026, which was the latest when we checked on the morning of October 30. That can change. (CISA KEV)
- How many sites use it. Drupal's project page says 42,002 sites report using Commerce Core when we checked. BleepingComputer and SecurityWeek both say "more than 42,000" sites. That counts sites that report using the module, not sites that are vulnerable or hit. (Drupal project page, BleepingComputer, SecurityWeek)
- Same release, other fixes. The same releases fix five lower-rated Commerce Core flaws, SA-CONTRIB-2026-255 to 259, rated from less critical to moderately critical. Drupal's advisories for those do not say they are exploited. SA-CONTRIB-2026-255 affects only 2.x and 3.x before 3.2.0. (Drupal contributed project advisories)
- A wording mix-up in some reports. BleepingComputer writes that versions "through 3.3.13" are affected. Drupal's advisory says before 3.3.13, and that 3.3.13 is the fixed release. The CVE record's version data says the same. We use Drupal's range. (Drupal advisory, CVE record, BleepingComputer)
Who should worry
This is about online stores and other sites built on the Drupal Commerce module. If your store is on Shopify, WooCommerce, Wix or another platform, this notice does not apply to you. If you are not sure what your store runs, ask your developer or agency. Ask about this if any of these are true:
- Your shop runs on Drupal and takes orders through the Commerce module.
- Your developer or agency built a Drupal store and you have never seen an update to it.
- You run a web agency or host that looks after Drupal stores for clients.
Drupal sites that do not use the Commerce Core module are not covered by this advisory.
What to do now
Do these today.
- Find out if you have it and which version. Your developer can check the Commerce Core version in the Drupal admin screens, or by running
composer show drupal/commerceon the server. - Update. Move 3.x sites to Commerce Core 3.3.13 and earlier sites to 8.x-2.41, as Drupal says. Take a backup first. Afterwards, place a test order. Drupal's advisory lists no workaround, so we do not know of a safe way to skip the update. (Drupal advisory)
- If you cannot update today, ask your developer or host whether they can switch the store to maintenance mode until the update is done. That is our suggestion, not Drupal's.
- Audit your orders. Drupal says: "Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited." Drupal has not said when attacks began, so look further back than October 28. Ask your developer to compare your Drupal orders with what your payment provider shows, and to look for orders marked as paid with no matching payment, unusual totals or discounts, changed order states, and orders with missing or odd customer details. These checks are our suggestions for how to follow Drupal's advice. (Drupal advisory)
- If you find anything odd, tell your developer and your payment provider, hold any suspicious orders before you ship or fulfil them, and keep the logs.
- Check your other Commerce add-ons. Drupal published advisories on the same day for Commerce Stripe, Commerce Shipping and Commerce License (SA-CONTRIB-2026-260 to 265). Ask your developer to check them on the Drupal contributed project advisories list. We do not know whether you are affected. (Drupal contributed project advisories)
What to send your developer or agency
Drupal published SA-CONTRIB-2026-254 on October 28, 2026 for Commerce Core, CVE-2026-118539, rated highly critical (21 out of 25), an access bypass that Drupal says is being actively exploited in the wild. Affected versions are 3.x before 3.3.13 and 8.x-2.x before 8.x-2.41. Please tell us whether our store uses Commerce Core, which version it is on, and when you will update to 3.3.13 or 8.x-2.41. Drupal says sites should audit their orders for inconsistencies, so please also compare our orders with our payment provider's records, going back further than October 28, and tell us what you find. Please also check our Commerce add-ons against Drupal's advisories SA-CONTRIB-2026-260 to 265. Sources: Drupal advisory, SecurityWeek.
Common questions
Has my store been hacked?
This notice does not mean your store has been hacked. It means a serious flaw is public, Drupal says it is being used in attacks, and a fix is out. The way to know is the update and the order audit above.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see whether your store runs Drupal Commerce, which version it is on, or what is in your orders. A clean EverThread result does not mean your store is safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
How is it being exploited, and how many stores were hit?
Drupal has not said. Its advisory confirms attacks and nothing more about them. We will not guess. (Drupal advisory, SecurityWeek)
Is 3.3.13 vulnerable?
No, according to Drupal. 3.3.13 is the fixed release for 3.x. Some news reports say "through 3.3.13", which does not match Drupal's advisory. (Drupal advisory, BleepingComputer)
Is this on CISA's list of exploited flaws?
Not in the version dated October 29, 2026, when we checked on October 30. (CISA KEV)
Where can I follow official updates?
The Drupal advisory is the primary source. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Drupal Security Team: Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254, October 28, 2026, checked October 30, 2026
- Drupal.org: Commerce Core project page and releases, 3.3.13 and 8.x-2.41 released October 28, 2026, checked October 30, 2026
- Drupal Security Team: Security advisories for contributed projects, including SA-CONTRIB-2026-255 to 265, checked October 30, 2026
- Drupal Security Team: Security risk levels defined, checked October 30, 2026
- CVE Program: CVE-2026-118539, published by Drupal, checked October 30, 2026
- BleepingComputer: Drupal warns of critical Commerce Core flaw exploited in attacks, October 30, 2026
- SecurityWeek: Drupal Commerce Core Vulnerability Exploited Against Online Stores, October 30, 2026
- CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 29, 2026, checked October 30, 2026