The Drupal security team has warned about CVE-2026-118539, a missing authorisation flaw in the Commerce Core module that attackers without an account are already exploiting, BleepingComputer reports. Versions up to 2.41 and 3.0.0 to 3.3.13 are affected, and Drupal is asking for an immediate upgrade and a check of orders for inconsistencies. The module, used by more than 42,000 sites, did not properly protect certain routes and fields, with possible financial harm to the seller. It is the third serious Drupal warning in a few weeks.

What it means: Drupal's wording, that the flaw may harm the seller financially, means in practice that someone can change order details, prices or payment status without permission. This kind of attack is not always visible at once, because the shop keeps working normally and the damage shows up in payment reconciliation or shipments. That is why the advice to audit orders matters as much as the upgrade. For Greek online shops running Drupal, this means comparing the amount of each order with what the payment provider actually collected over recent weeks, and looking for orders whose status changed without a matching transaction. Owners who have outsourced maintenance should ask for written confirmation of the installed version. The frequency of recent Drupal warnings shows attackers are watching the platform closely, so a maintenance contract that commits to applying critical updates within hours, and to testing the shop afterwards, is now a necessity rather than a luxury.

Read the original on BleepingComputer

Related service: Custom software

Related stories