Drupal Issues Emergency Advisory for Critical Commerce Core Vulnerability Exploited in the Wild

Drupal’s security team has issued an urgent advisory warning that a critical access‑bypass flaw in the Commerce Core module is being actively exploited by attackers, prompting site owners to apply the newly released patch without delay.

The vulnerability allows unauthenticated users to circumvent the module’s permission checks, potentially granting them the ability to manipulate e‑commerce functions such as creating, editing, or deleting orders and product listings. In practical terms, an attacker could gain administrative‑level control over a store’s transaction workflow, opening the door to fraud, data theft, or site defacement.

Disclosed in the latest Drupal security announcement, the flaw has been assigned a CVE identifier and a patch has been made available in the current release of Commerce Core. The advisory notes that exploitation is already occurring in the wild, underscoring the immediacy of the threat and the necessity for rapid remediation.

Sites that run Drupal with the Commerce Core extension—ranging from small boutique shops to large enterprise platforms—are directly affected. Because the module handles payment processing and customer information, a successful breach could expose sensitive personal data and disrupt financial operations. The advisory stresses that the impact extends beyond technical inconvenience, posing real financial and reputational risk to merchants.

Administrators are urged to download and install the security update as soon as possible, verify that the patched version is active, and review server logs for any signs of unauthorized activity. In addition, resetting administrative credentials and conducting a thorough security audit are recommended steps to mitigate any potential compromise that may have occurred before the patch was applied.

The incident arrives at a time when Drupal continues to be a backbone for many high‑profile websites, including government portals and commercial enterprises. Past security issues have demonstrated the platform’s attractiveness to threat actors, reinforcing the community’s reliance on prompt updates and responsible disclosure practices.

Looking ahead, the Drupal security team has indicated that it will monitor the situation closely, release further guidance if new attack vectors emerge, and continue hardening the Commerce Core codebase. Security researchers and developers are encouraged to report any related findings through Drupal’s established vulnerability reporting channels to help safeguard the ecosystem.