Drupal Commerce Flaw Lets Attackers Change Prices and Read Coupons: What Online Stores Should Check (CVE-2026-118539)

On October 28, 2026, the Drupal security team released fixes for a highly critical flaw in Commerce Core, the module that turns a Drupal website into an online store. Two days later Drupal confirmed it was already being exploited. The vulnerability, CVE-2026-118539, lets people change parts of orders, carts and products they should never be able to touch, including the price a customer pays.

Commerce Core runs on more than 42,000 websites, according to BleepingComputer, from small shops to large companies and universities. If your online store is built on Drupal, this article tells you how to check whether you are affected, what to update and what to look for in your orders.

The flaw at a glance

What attackers can do

Drupal’s advisory says the module “doesn’t sufficiently protect certain routes and entity fields” and that the bypass “may financially impact the vendor”. An analysis of the fix by Ostorlab lists what the missing checks allowed before the update:

• Customers changing their own cart. Fields such as the unit price, order total, adjustments and order state could be written through Drupal’s JSON:API or REST interfaces. In plain terms: paying less than the real price.
• Reading coupon codes. An autocomplete page listed coupon codes to anyone who could reach it, including codes for promotions the account could not manage.
• Moving coupons and products. A coupon could be moved to a different promotion, and on marketplaces with several vendors, one vendor’s product variations could be moved under a product controlled by someone else.
• Seeing hidden products. Filters in JSON:API revealed that unpublished product variations existed.

Based on the published information, this is not a full takeover of the website and there are no reports of attackers reading customer data through it. It is a direct way to lose money: discounted orders, leaked or misused coupons and corrupted product data.

“Not every serious flaw leaks data. Some simply let the customer decide the price.”

NyorsoftExternal Security Review

Are you affected?

1. Is your store built on Drupal? If you use Shopify, WooCommerce or another platform, this specific flaw does not apply, but the checks below are still a good habit.
2. Which Commerce Core version do you run? In Drupal go to Reports → Available updates (or ask your developer to run composer show drupal/commerce). Anything below 3.3.13, or below 2.41 on the older branch, is vulnerable.
3. Are JSON:API or REST enabled? Many cart and order changes went through these interfaces. If your store does not need them, they should not be switched on.

What to do now

1. Update Commerce Core to 3.3.13 or 8.x-2.41 (or later) and clear caches. Take a backup first.
2. Update Drupal itself. Drupal also fixed two remote code execution flaws two weeks earlier (CVE-2026-108097 and CVE-2026-108099), so make sure core and all modules are current.
3. Disable interfaces you do not use. If the store does not need JSON:API or REST, turn those modules off; if it does, check which roles are allowed to write through them.
4. Rotate exposed coupon codes. Assume codes that were reachable through autocomplete could be known. Disable or replace high-value codes.

How to check your orders for abuse

Drupal has not published indicators of compromise, so the check is a business one: look for orders that do not add up. Go through orders since at least the start of October and look for:

• Orders where the line prices or total are lower than your product prices and discounts would allow.
• Coupons used far more often than expected, or codes that were never shared publicly.
• Coupons now attached to a different promotion than the one that created them.
• Product variations that suddenly belong to a different product or vendor.
• In server logs, write requests (POST or PATCH) to JSON:API or REST endpoints for orders, carts, coupons or products from customer or low-permission accounts.

If you find suspicious orders, hold them before shipping, keep the logs and talk to your payment provider about refunds or chargebacks.

The broader lesson for online stores

This is the third widely used web component hit by active attacks this month, after PHP2Shell and the WordPress plugin compromises. Online stores are attractive targets because they handle money directly. Three habits make the biggest difference:

• Know which platform, modules and versions your store runs, and who is responsible for updating them.
• Apply security updates for your shop software within days, not months.
• Reconcile orders against payments regularly, so pricing anomalies are caught early.

An external website security review shows what your store reveals from the outside, such as visible software versions, exposed interfaces and missing security settings. Our free website security check is a quick first step.

Sources

• BleepingComputer: Drupal warns of critical Commerce Core flaw exploited in attacks (October 30, 2026)
• Security Affairs: Attackers exploit critical Drupal Commerce Core vulnerability CVE-2026-118539
• Ostorlab: Drupal Commerce access bypass, exploited in the wild (CVE-2026-118539)
• Drupal security advisory SA-CONTRIB-2026-254

This article summarises public information as of October 31, 2026. Check Drupal’s advisory for the latest guidance.

Written byPavol Huňor · IT Analyst, Nyorsoft

Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team