Drupal's security team says attackers are already exploiting a missing-authorization flaw in Commerce Core, the module that turns a Drupal site into an online store. No account is needed to abuse it.
What happened
The flaw is tracked as CVE-2026-118539 and classified as CWE-862, missing authorization. Commerce Core does not sufficiently protect certain routes and entity fields, which lets an unauthenticated visitor reach data and actions that should require a logged-in user. Drupal's record calls the outcome forceful browsing and warns it may cost the vendor money.
The Drupal security team published advisory SA-CONTRIB-2026-254 on 30 October and rated it highly critical. Its wording is blunt: the vulnerability is being actively exploited in the wild. The affected range runs from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13, with fixes in Commerce Core 3.3.13 and 8.x-2.41. Commerce Core is installed on more than 42,000 sites according to reporting on the advisory.
Who is affected
- Any Drupal site running Commerce Core 3.0.0 through 3.3.13 on the 3.x branch
- Older installs on Commerce Core 0.0.0 through 2.41, which need 8.x-2.41
- Stores that take orders, quotes or payments through Commerce checkout or its API, because an attacker needs no login to probe those routes
What to do now
Update Commerce Core to 3.3.13 on the 3.x branch, or 8.x-2.41 if you are on the 2.x line, today, then audit recent orders for inconsistencies. The Drupal team asks for that audit explicitly, because an access bypass on a storefront is a data and revenue problem, not only a web security one.
- Take a database and files backup before the module update, then run database updates and clear caches
- Pull web server logs for the last few weeks and look for unauthenticated requests to commerce routes, order endpoints and admin paths that returned 200
- Compare order totals, shipping addresses and payment references against what your payment gateway reported for the same period
- Check whether any Commerce-related API or decoupled front end consumes those same routes, since those consumers bypass Drupal's usual page rendering
What this means for South African businesses
Drupal is less common than WordPress in the local SME market, but where it is used it tends to sit on stores that take real money, which makes an unauthenticated access bypass far more expensive than a cosmetic plugin bug. Most small South African retailers will not be scanning their own application logs for forceful browsing, so the realistic exposure is a store that patched the module eventually but never checked whether anyone walked through the hole first. If your storefront was built on Drupal Commerce, treat the order audit as mandatory rather than optional.
Source
The Drupal security advisory SA-CONTRIB-2026-254 is the primary source: drupal.org/sa-contrib-2026-254, with the identifier record at cve.org.