Drupal Commerce Core flaw used to place fraudulent orders: update to 3.3.13 and audit orders

Timing: Drupal published the advisory and the fixes on 28 October 2026. The CVE record went public on 30 October. We publish on 30 October, two days after the patch release.

What happened

Attackers used a flaw in Drupal Commerce Core to place fraudulent orders on live shops. Some orders carried obviously wrong prices, such as $0.01. Others carried normal prices.

The flaw is CVE-2026-118539. The Drupal Security Team published it as SA-CONTRIB-2026-254 on 28 October. Drupal rates it Highly critical 21/25 and says it "is being actively exploited in the wild".

The advisory says the module does not protect certain routes and entity fields well enough. That access bypass "may financially impact the vendor", meaning the shop owner. Drupal's risk vector says no login is needed.

Centarro, which maintains the module, posted details on 29 October with the Drupal Security Team. It says it received two reports from merchants who saw suspicious activity on live sites.

Who is affected

Commerce Core is a contributed module (machine name commerce). It is not Drupal core. Updating Drupal core does not fix this flaw.

• 3.x: 3.0.0 up to, but not including, 3.3.13.
• 8.x-2.x: every release before 8.x-2.41.
• How long: Centarro says the flaw was possible since 8.x-2.18 (May 2020) on sites using JSON:API. For all other sites, since 8.x-2.25 (June 2021).
• Site types: both full-stack and headless (decoupled) shops. The attack route differs between the two.

What is confirmed

• Exploitation. Both Drupal and Centarro confirm it. The source is two merchant reports of fraudulent order attempts.
• The fix. Commerce Core 3.3.13 and 8.x-2.41, released on 28 October.
• Other fixes in the same releases. They also close SA-CONTRIB-2026-255 to -259. Drupal rates those moderately critical or lower.
• Related modules. Centarro shipped same-day security releases for Commerce API, Commerce License, Commerce Shipping and Commerce Stripe. It says to update them at the same time.
• The weakness. The CVE record lists CWE-862, Missing Authorization.

What is not confirmed

• No campaign. Centarro and the Drupal Security Team say they do not believe it was scripted or exploited beyond the first sites. That is their view as of 29 October.
• No attacker named. No indicators of compromise or request details are public.
• No CVSS score. NVD has not analysed the CVE. Drupal's 21/25 is its own scale, not CVSS.
• Not in CISA KEV. We checked catalog 2026.10.30 on 30 October.
• No public PoC. We found none.
• Zero-day status is unclear. Merchants saw abuse and reported it. The sources do not say whether attacks came before the fix. We do not label it a zero-day.

What to do

1. Update Commerce Core now. Use 3.3.13 on 3.x or 8.x-2.41 on 8.x-2.x. Update through Composer (drupal/commerce).
2. Update the related modules if you use them: Commerce API, License, Shipping and Stripe.
3. Close JSON:API writes you do not need. Centarro advises switching JSON:API back to read-only if your site does not need update operations. Still patch.
4. Audit recent orders. Drupal and Centarro both ask for this. See the checklist below.
5. Hold fulfillment until payment is confirmed. Centarro says checkout completion is not proof of payment. Check full payment before you ship goods or deliver services.
6. Plan off 8.x-2.x. Centarro says 8.x-2.x support ends when Drupal 12 is released.

How to audit your orders

Centarro's checklist covers four signs, from simple to advanced. Each can also have a legitimate cause on your site.

• Placed but not paid. Orders with no pending or authorized payment. This matters most if your shop does not allow free orders.
• Paid with no payment record. Orders marked paid with no payment attached. This mostly concerns sites that allow JSON:API updates.
• Odd unit prices. Prices no promotion or rule explains. An "Override the unit price" box ticked when staff did not tick it is a warning sign.
• Unknown adjustments. Discounts, fees or other adjustments your staff did not add and no promotion created.

Centarro also publishes read-only database queries for these checks. It suggests matching each suspect order's IP address and time against access logs. Orders placed the normal way go through the checkout path.

If you find suspicious orders, report them through Drupal's confidential security process.

Related coverage

Browse other Drupal records on the Drupal vendor tracker.

Record: CVE-2026-118539.

Sources: Drupal SA-CONTRIB-2026-254, the Commerce Core 3.3.13 and 8.x-2.41 release notes, Centarro, CVE.org, NVD, GitHub Advisory Database and the CISA KEV catalog. Links are in the references list.