CVE-2026-118539: Drupal Commerce Core exploited in the wild
Drupal Commerce Core authorization bypass exploited in the wild, with direct financial impact on the merchant. Fixed versions and an audit plan.
Who is affected
- Drupal Commerce Core versions before 2.41 on the 8.x-2.x branch
- Drupal Commerce Core versions before 3.3.13 on the 3.x branch
- Hotel, spa or resort online stores selling stays, treatments, tickets or goods on Drupal Commerce
How to fix
Upgrade to Drupal Commerce Core 3.3.13 (3.x branch) or 2.41 (8.x-2.x branch), per advisory SA-Contrib-2026-254 dated October 30, 2026. Until the upgrade lands, restrict commerce routes with a server rule or WAF, and disable the selling function if it is not essential. After patching, audit the window since October 30: abnormal orders, refunds, price changes, and user accounts created or promoted. If exploitation is found, treat the payment perimeter as compromised and notify the acquiring bank.
What happened
Drupal published advisory SA-Contrib-2026-254 on October 30, 2026, covering its Commerce Core module. The module "doesn't sufficiently protect certain routes and entity fields," the vendor writes, letting an unauthorized visitor reach actions reserved to staff or checkout flows, with financial impact on the merchant. Drupal confirms the flaw, tracked as CVE-2026-118539, is being "actively exploited in the wild," without detailing the scale or nature of the campaigns.
Why it matters for a hotel
Commerce Core does not only power gift shops: it frequently carries spa treatment sales, event ticketing, rentals and stay add-ons. An authorization bypass on those routes can mean orders placed or altered outside any control, tampered prices, bogus refunds, and exposure of customer entity fields. Unlike a code-execution flaw, the damage here lands first on the till.
Who is affected
Every Commerce Core release before 2.41 on the 8.x-2.x branch and before 3.3.13 on the 3.x branch. The site administrator can read the exact version in the extension UI or through the Drush command line.
How to fix it
- Upgrade to Commerce Core 3.3.13 (3.x branch) or 2.41 (8.x-2.x branch), released alongside the October 30 advisory.
- If the upgrade cannot land immediately, disable the selling function or restrict commerce routes with a server rule or WAF.
- Audit since October 30: abnormal orders and refunds, price drift, accounts created or promoted.
- If exploitation is found, treat the payment perimeter as compromised and notify the acquiring bank; Drupal has not published indicators of compromise.
Context
The flaw carries no public CVSS score, NVD analysis is still pending; it is the vendor's own "highly critical" rating, combined with confirmed active exploitation, that drives prioritization. It lands in a week where the web layer of hospitality vendors was under pressure from every direction: WordPress core, PHP, Drupal. Hosts running Drupal-based booking sites should treat this upgrade as the week's priority change.