Hacker News is drawing attention to a Commerce Core access bypass in Drupal that is being exploited in the wild. Drupal says the flaw, tracked as CVE-2026-118539, affects online stores running the module.
The issue hits more than 42,000 sites. Administrators are being told to move to the fixed versions and check orders for irregularities.
Commerce Core on Drupal sites
Commerce Core adds e-commerce functions to Drupal websites, including a shopping cart and checkout process. Drupal says the module does not sufficiently protect certain routes and entity fields, and it rates the issue 21 out of 25.
That combination raises the stakes for store owners because the bug is not limited to authenticated users. Drupal says unauthenticated attackers can exploit it no matter how the module is set up.
Drupal order review
Drupal’s advisory says, "The module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor."
It also says, "Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited," which turns patching into a records check as well as a software update.
CVE-2026-118539 exploitation
The main gap is the method of abuse. Drupal says the attacks are happening, but it has not said how the bug is being exploited, who is behind the activity, or how many sites have been targeted.
The same security team has also been busy elsewhere. On October 14, Drupal announced fixes for two critical remote code execution bugs, and on October 28 it published 38 other advisories across 21 contributed projects.
For operators of Drupal stores, the immediate job is to patch to one of the two fixed versions, 3.x versions before 3.3.13 or earlier releases before 8.x-2.41, and then compare recent orders against expected payment flow. The open question is how this campaign is being carried out and whether the abuse reached sites before fixes were available.
