In yet another episode of “What could possibly go wrong?” Drupal is alerting all you Commerce Core users out there: there's a juicy flaw being exploited by hackers. Yes, you heard that right. Apparently, some bright spark forgot to put a lock on the cookie jar, and now it's open season for attackers.
This particular debacle is known as CVE-2026-118539—a fancy name for a gaping hole in the system that allows unauthorized folks to slip through the cracks. If your version of Commerce Core ranges from 0.0.0 to 2.41 or 3.0.0 to 3.3.13, congratulations! You’re on the invite list for this cyber chaos.
The Drupal security squad has issued an urgent plea: update to Commerce Core 3.3.13 immediately. And while you're at it, go ahead and inspect your orders for any funny business, because guess what? Criminals are already at work.
As Drupal so eloquently puts it, “This module enables you to sell goods and services to customers...”—a real game changer, unless you’re on the receiving end of a data breach, of course. It turns out that some routes just didn't get the memo about needing protection, so attackers are having a field day.
This isn’t Drupal’s first rodeo, either. Back in May, they had to deal with an SQL injection mess (CVE-2026-9082) that could let anyone wielding it gain unauthorized access. And just for kicks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) even had to step in and tell federal agencies to patch up their systems posthaste. Because nothing says “trustworthy” like being told to secure your software by government regulators.
Just two weeks ago, Drupal had to patch two more remote execution vulnerabilities. You’d think they’d get a break, but hackers clearly have other plans. If you’re not quick on those updates, the attackers could whip up new exploits quicker than you can say “data breach.”
In the grand scheme of things, this is just one of five Drupal vulnerabilities that have been flagged in recent years. Some of these have even been used by ransomware gangs—because what’s a little chaos among friends, right?
So, if you value your site and your sanity, heed the warning: update, audit, and pray your website doesn’t become the next target in a long line of Drupal’s unfortunate mishaps.
