Drupal has disclosed an actively exploited critical authorization bypass flaw in its Commerce Core component, tracked as CVE-2026-118539.
Affecting versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13, the vulnerability impacts route and entity field protection across checkout flows and APIs.
Upgrades are available for affected instances.
The issue concerns the Drupal Commerce Core plugin and affects versions 0.0.0 to 2.41, as well as 3.0.0 to 3.3.13. According to the update, the system does not properly protect certain areas and data, resulting in bypassing access rules. This may cause financial loss to store owners.
Those responsible confirm that the attacks are actually happening, without however providing further details about the extent or how they are unfolding.
Who is affected and what needs to be done?
The issue affects those using previous versions of this plugin to sell products and services. Administrators are urged to immediately upgrade the plugin to the latest version.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Issues at GitLab and Cisco added to US list of active attacks
↗
For those using the 3.x series, version 3.3.13 is recommended, while for older versions, version 8.x-2.41 is recommended. The issue was discovered and reported by researchers Dan Puccetti, Marcus Johansson, and Robert Snyder.
Developments in other systems
At the same time, attack attempts are underway on other fronts, which concern two serious security problems in the PHP programming language, known collectively as PHP2Shell.
According to data from security firm Wiz, the percentage of organizations significantly impacted by these issues had fallen to 52,1% as of October 25. The firm has observed two distinct patterns of activity. One involves efforts that leverage publicly available attack tools, while the other involves separately named tools that rely on different mechanisms, such as session tampering and exploiting other vulnerabilities.
The researchers note that simply causing memory exhaustion is not enough to complete an attack, as differences in the configuration and memory limits of systems can hinder the attackers' next steps. The research was written by Yaara Shriki, Shahar Dorfman, Alma Blachsan, and Yaron Samuel.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)