Drupal has issued a high-severity warning about an actively exploited vulnerability in its Commerce Core module that could allow attackers to place orders at drastically reduced prices, such as $0.01. The issue, designated CVE-2026-118539, involves missing access controls in certain routes and entity fields within the Commerce Core, potentially exposing sensitive operations like order modification without proper permissions.
What’s at risk
The flaw impacts Commerce Core versions prior to 2.41 in the 8.x-2 branch, and versions from 3.0.0 up to but not including 3.3.13 in the 3.x stream. Administrators are urged to update to 8.x-2.41 or 3.3.13 to close the gap. Without this update, sites remain vulnerable under all module configurations.
Drupal has confirmed active exploitation but hasn’t released specifics about how attackers are manipulating prices or which sites have been victimized. While the advisory doesn’t fully verify orders are being placed for exactly $0.01, it warns that unauthorized data changes and financial losses may already be underway.
How it works and what to do
At the core of the vulnerability are missing checks around certain “routes” — paths that define how requests are handled — and “entity fields,” which store data tied to things like products or orders. If these are not properly secured, malicious actors might invoke functions or alter data they should not have access to.
Commerce Core functions as the backbone for many Drupal-based online stores, powering carts, checkout processes, and API-connected storefronts. With over 42,000 reported installs, the vulnerable population is sizable, though not all instances may have been compromised.
Site owners are advised to immediately apply the available patch. Beyond the software update, Drupal recommends auditing past orders for pricing irregularities—particularly where prices or payment information don’t match expected patterns. Such reviews can uncover signs of malicious interference even if the specific attack method hasn’t been disclosed.
This issue is distinct from remote code execution vulnerabilities previously seen in Drupal; this one centers on misconfigured permissions that enable unauthorized control over order data rather than full system takeover.
Disclosure credits go to researchers Dan Puccetti, Marcus Johansson, and Robert Snyder for identifying the flaw. Drupal’s advisory, published on October 28, 2026, includes detailed recommendations for patches and mitigations.
What this means: E-commerce sites running Drupal are facing serious risk from this vulnerability. The potential for fraud, revenue loss, and trust damage is significant. Moving forward, store operators should treat this as a wake-up call to regularly test for access control gaps—not only in core software but in modules that touch payment or order logic. Vigilance and proactive patching are key to preventing attackers from exploiting similar weaknesses.
