Drupal has issued an urgent warning after attackers began exploiting a severe authorization bypass vulnerability in its Commerce Core component. Tracked as CVE-2026-118539, the bug impacts versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13 of Commerce Core. The flaw enables unauthorized access to certain protected routes and data fields, putting financial operations and vendor trust at high risk.
What’s at Risk
The Commerce Core module is essential for Drupal sites selling goods or services. It includes shopping carts, checkout, and APIs used by decoupled front ends. The flaw doesn’t properly guard some API endpoints and entity fields, allowing malicious actors to bypass authorization checks. If exploited, attackers could gain access to features or information meant only for privileged users, leading to financial exposure or data breaches.
Updates and Versions
Sites running Commerce Core from the 3.x branch should update to version 3.3.13. Those using earlier 8.x-2.x versions should move to 2.41. These versions include fixes that close off improperly protected routes and tighten authorization checks. Drupal credits security researchers Dan Puccetti, Marcus Johansson, and Robert Snyder with responsibly reporting the vulnerability.
This disclosure comes amid broader concerns around PHP2Shell, a separate pair of critical remote execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) with CVSS scores of 9.2. Observers say many organizations still face active exploit attempts tied to PHP2Shell, though about 52.1% are significantly affected, according to cloud security monitoring. Attackers are using both publicly released proof-of-concepts and other methods like session poisoning and local file inclusion to try to complete exploit chains.
The fact that CVE-2026-118539 is already being used “in the wild” underscores its urgency. Drupal’s advisory doesn’t provide details on how widespread attacks are, but it notes that the vulnerability could have “financial impact” for site operators and vendors.
You can protect your site by upgrading immediately. For version 3.x, use 3.3.13; for earlier versions, the recommended patch is 2.41. Failing to apply updates leaves sites exposed to credential bypass or unauthorized data access.
Drupal’s discovery of this flaw highlights how even authorized modules can introduce serious security holes when access controls are inadequate. As threat actors shift toward exploiting such bypasses, securing every route, API, and field becomes non-negotiable. Watch how vendors respond, especially those with older Commerce Core versions. The severity of CVE-2026-118539 reflects a broader pattern: vendors must assume that flaws will be targeted swiftly once announced, and treat updates not as optional but as essential defense.
