Critical Drupal Commerce Vulnerability Could Let Hackers Buy Products for Just $0.01

Drupal has warned that hackers are actively exploiting a highly critical security flaw in Commerce Core, putting online stores at risk of financial losses.

Tracked as CVE-2026-118539, the vulnerability lets attackers bypass access checks in the module used to sell products and services on Drupal websites and connected shopping applications.

The warning raises concerns about unauthorized changes to store data and transactions. However, Drupal has not confirmed that attackers can buy products for exactly $0.01.

The public advisory does not document that price, describes a potential financial impact, and does not name the fields attackers can change or explain how observed attacks worked.

Published on October 28, 2026, the official Drupal security advisory identifies insufficient protection around certain routes and entity fields. Routes handle requests to website functions, while entity fields hold data associated with site records. Missing access checks can let someone reach functions or data they should not control.

Critical Drupal Commerce Vulnerability

Drupal assigned the flaw a risk score of 21 out of 25, placing it in its “Highly critical” category. This is Drupal’s own security scale, not a CVSS score. The assessment indicates that exploitation requires no authentication and affects all configurations of vulnerable module versions.

The rating also identifies possible exposure of some private information and changes to some data. Drupal has confirmed active exploitation but has not published affected store names, attack volumes, or a detailed attack method. The advisory does not establish remote code execution or full website takeover.

Commerce Core supports shopping carts, checkout forms, and separate applications connected through APIs. Its project page reports more than 42,000 websites using the module. That figure reflects reported installations, not the number of stores confirmed vulnerable or compromised.

The vulnerability affects Commerce Core versions before 2.41 and versions from 3.0.0 up to, but not including, 3.3.13. Administrators running the 3.x branch should install Commerce Core 3.3.13. Sites using earlier versions should upgrade to Commerce Core 8.x-2.41, following Drupal’s published guidance.

These are Commerce module updates, separate from Drupal core security releases. Earlier coverage of a critical Drupal remote code execution vulnerability concerns a different flaw. Store owners should check the installed Commerce package rather than assume a recent Drupal core update fixed this issue.

Drupal explicitly advises affected sites to audit orders for inconsistencies because exploitation is already underway. Beyond applying the update, a practical review should compare recorded orders with expected prices and payment records, investigating unexplained differences rather than treating them as proof of compromise.

This threat differs from Magecart attacks that target online checkout pages and steal customer payment details. Here, Drupal’s warning centers on broken access controls and possible merchant losses.

Researchers Dan Puccetti, Marcus Johansson, and Robert Snyder reported the vulnerability. Prompt patching and order checks remain the immediate priorities for affected online stores.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.