Drupal's Commerce Core Flaw Is Being Exploited Right Now

Emily Davis · 2026-10-30

If you run a Drupal site with the Commerce Core module, this one deserves your attention today. Drupal issued a warning about a critical access bypass vulnerability in Commerce Core — and attackers are already exploiting it in the wild. That's not a theoretical risk. That's active abuse happening while many admins are still catching up on their patch queues. Let's break down what's going on, why it matters, and what you should do next. ### What the Vulnerability Actually Does An access bypass flaw is sneaky by nature. It doesn't crash your site or leave a loud error message. Instead, it lets someone slip past permission checks they were never supposed to clear. In the context of Commerce Core, that could mean access to order data, customer information, or other pieces of your storefront that should sit behind a login wall. Here's the part that stings: these bugs often stay quiet. You might not notice anything unusual until someone points it out — or worse, until customer data shows up somewhere it shouldn't. ### Why "Exploited in the Wild" Is the Phrase That Matters Plenty of vulnerabilities get disclosed and then sit around unused. This one is different. Drupal confirmed that attackers are actively using it, which changes your timeline completely. This isn't a "patch it during next month's maintenance window" situation. It's a "patch it now" situation. If you're running an e-commerce site, think about what's exposed: customer records, order histories, payment-adjacent details. The kind of data that carries real regulatory weight in the US and real reputational damage if it leaks. ### What You Should Do Right Now - Update the Commerce Core module to the latest patched version immediately. - Check whether your site has already been probed or accessed — review logs for unusual requests. - If you use a managed host or a security team, confirm they've applied the fix. - Rotate any credentials or API keys that could have been exposed. - Set up alerts for future Drupal security advisories so you're never the last to know. ### The Bigger Lesson for Anyone Managing a Storefront Here's something worth sitting with. Most site owners don't get breached because attackers are brilliant. They get breached because a patch sat unapplied for two weeks. Security advisories pile up, the to-do list grows, and the one line item that actually mattered gets buried under a hundred others. So if there's a takeaway beyond this specific flaw, it's this: treat critical advisories like a fire alarm, not a newsletter. Patch fast, verify, and move on. It takes twenty minutes. A breach takes months to clean up. > "The vulnerability you patch today is the crisis that never happens tomorrow." Stay ahead of it. Update Commerce Core, check your logs, and keep your storefront locked down.