Drupal warns of critical Commerce Core access bypass exploited in the wild
Drupal has warned administrators to patch a critical access bypass vulnerability in the Commerce Core module. According to the warning, attackers are exploiting the flaw in the wild.
Written by a model from the sources below. Verify against them.
- Kind
- Vulnerability
- Vendor
- Drupal
- Product
- Drupal Commerce core
- Status
- Reported, not confirmed
- First seen
What to do
Update the Drupal Commerce Core module to the patched version Drupal released.
Review site logs for unexpected access, privilege changes, or new admin accounts.
Audit user roles and access permissions on Commerce-based sites.
Timeline
- Made public by BleepingComputer on Bluesky
- First seen by cve.now2 days
- Record last updated
On X 6
ddimitrov22@ddimitrovv22In case you didn't follow cybersecurity in October: >Binance lost ~$6.3B from its hot wallets in about 20 minutes, the largest crypto theft ever -Initial entry point: one engineer's compromised laptop -Chainalysis and TRM both attribute it to North Korea's TraderTraitor >PHP2Shell: two 14 year old bugs in the PHP interpreter gave unauthenticated RCE on WordPress, Drupal and Joomla servers -PHP runs ~70% of websites with a known server-side language -Found with AI help >Amazon's honeypots logged a PHP2Shell exploit attempt 4 days before the bugs were disclosed >China-aligned Storm-0940 used a stolen ConnectWise Cloud Backup credential to target 2,250+ Microsoft 365 tenants -Recon to exfiltration was run by ARTEX, an open-source multi-agent AI system -No MFA prompt, they signed in as an already-trusted app >OpenAI notified 100+ organizations that its own "misaligned" AI agents may have accessed their systems -OpenAI confirmed the agents probed SEC, Commerce and Education Department sites >LiteLLM's release pipeline was hijacked with stolen GitHub tokens and shipped a stealer to PyPI and Docker Hub -~23M weekly downloads, malicious version live for ~100 minutes -Stole cloud keys, SSH keys and Claude/Codex/Cursor auth files -Their second supply chain attack this year >Australia's cyber.gov.au went offline the night the PHP2Shell patches dropped -Along with government sites in France, Finland, Denmark and the Netherlands >A malicious Claude Code extension shipped under Anthropic's own extension ID on Cursor's marketplace -Added an attacker SSH key labeled "svc-telemetry" -Up to 5,000 users installed it in ~11 hours >Ledger X devices sold by a Malaysian reseller had a hardware implant that read seed phrases and sent them out over LTE -Researchers estimate $86M-$93M stolen from 300+ wallets >Capcom confirmed 11.77M CAPCOM ID records were accessed >Zeabur got breached twice in 2 months, then announced it's shutting down -2nd breach: long-lived admin credentials stored in plaintext -3.2M environment variable records exposed >eMudhra generated 8 intermediate CA keys with weak randomness, Chrome and Firefox blocked them, and eMudhra quit the global TLS business days later >GitLab patched two CVSS 10.0 RCEs in 9 days -The second one affects releases back to 2014 >Panasonic: an employee uploaded HR data on ~330K current and former staff and their families to a banned external AI tool -No hacker involved >Polymarket users lost ~$2.7M after a website performance script was hijacked to drain logged-in accounts -Second vendor-script drain on Polymarket this year >Rank Math PRO's own update server shipped a backdoor to WordPress sites for 11 hours >Plex2Shell got exploited a day after details went public -The attackers named their miner process "mylovelyminer" >A grey-market relay reconfigured Codex and Claude Code at 12 orgs to send all traffic through its servers and turn the sandbox off >Quest Diagnostics took its lab ordering system offline after unauthorized access, patient records believed exposed >CoinDCX confirmed a $16M loss days after its CEO called the reports a "false alarm" >Smaller crypto hits: -X100 $4.75M (flash-loan governance attack) -zkLink Nova $783K (bridge message replay) -Predict.fun $400K (compromised docs site) >Let me know what I missed If you work in security but don't have time to read 40 advisories a day - I post about web3 security every day. Follow so you catch the next recap🫡
ThreatWire@ThreatWire_🚨 ACTIVELY EXPLOITED: Drupal Commerce Core authorization flaw (CVE-2026-118539, Highly critical 21/25) Impact: attackers placed fraudulent orders on live shops, some at $0.01. No login needed. • Affected: Commerce below 8.x-2.41, and 3.0.0 to 3.3.12 • Fixed: 3.3.13 / 8.x-2.41 (patched Oct 28) • Status: exploitation confirmed by Drupal, 2 merchants reported so far. Not in CISA KEV, no public PoC • Contrib module, not Drupal core Do now: update, then audit recent orders for odd prices or paid orders with no payment. threatwire.tech/threats/drupal…
D0xed Dev@D0xedDevi0🟦😎 NO LOGIN. NO MALWARE. JUST ORDERS THAT NEVER GET PAID. CVE-2026-118539 — critical access bypass in Drupal Commerce Core, exploited in the wild. Requests look like normal storefront traffic. Patch 3.3.13 / 8.x-2.41, audit orders. via @PCMedicalist
Show 3 more posts
Azubuike Ibe@ai_dev_officialDrupal has confirmed that a highly critical flaw in Commerce Core is being exploited in the wild. The advisory is SA-CONTRIB-2026-254. The module does not sufficiently protect certain routes and entity fields. The result is an access bypass that can hit the store owner financially. The fix is to upgrade. On the 3.x branch, that means Commerce Core 3.3.13. Running an earlier branch? Check the advisory for your fixed release. Patching is only half the job. Because this is under active attack, audit your orders. Look for anything you cannot explain. Teams treat CMS platforms as lower priority than custom APIs. Attackers do not. A commerce module touches money, so it needs the same patch speed as your core backend. My name is Azubuike Ibe and I keep saying the shop front is a production system, because attackers already treat it like one. Follow me for more on the unglamorous platforms attackers keep finding first. #Cybersecurity #Drupal #ECommerce #DevSecOps #AppSec
Speaker 25@rodtrentSecurity Check-in Quick Hits: Record $6.3B Binance Heist, Exploited Drupal Commerce Flaw, Trojanized Claude Code Extension, and Critical GitLab/Cisco KEV Additions go.rodtrent.com/go/pg8nwft #Security #Cybersecurity
Rui Miguel Feio@rfeioAttackers are exploiting a critical Drupal Commerce Core vulnerability (CVE-2026-118539), highlighting the risks facing e-commerce platforms and the importance of timely patching to protect business operations and customer data.securityaffairs.com/202162/securit…
Evidence 4
- PressBleepingComputer on Bluesky
“Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.”
- SocialMastodon
“https://www. securityweek.com/drupal-commer ce-core-vulnerability-exploited-against-online-stores/”
- Social
- SocialMastodon
“Drupal flags a Commerce Core flaw as actively exploited: order tampering, not data theft.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-0a64a5d1f9
Has Drupal confirmed it?
BleepingComputer on Bluesky, Mastodon and Mastodon report it. No statement from Drupal has reached cve.now yet.Source: BleepingComputer on Bluesky, Mastodon, Mastodon, Mastodon
What should Drupal users do?
Update the Drupal Commerce Core module to the patched version Drupal released. Review site logs for unexpected access, privilege changes, or new admin accounts. Audit user roles and access permissions on Commerce-based sites.