A Drupal shop module flaw is being used to place orders for one cent

Orders placed at an obviously fake price, such as one cent. Others at a normal price, but just as fraudulent. That is what two merchants found in their online stores, according to Centarro, the company that maintains Commerce Core. The module turns the Drupal content management system into an e-commerce site.

On October 28, the Drupal security team published advisory SA-CONTRIB-2026-254, which fixes a Commerce Core vulnerability tracked as CVE-2026-118539. It is rated “highly critical,” with a score of 21 out of 25. The advisory is blunt: the flaw is being actively exploited. According to Drupal, the module is installed on more than 42,000 sites.

No account needed to exploit it

Drupal describes an access control bypass. Some of the module's routes and fields are not sufficiently protected, which “can have a financial impact for the vendor.” An anonymous visitor can exploit the flaw without any particular skill. All module configurations are affected.

The Drupal advisory does not specify the attack method, the origin of the attacks, or the number of sites targeted. Centarro provides a few more details. Traditional stores and so-called “headless” stores, where the public-facing site is separate from Drupal, are both affected, but through different paths. According to the vendor, the flaw was theoretically exploitable since version 8.x-2.18 from May 2020 for sites using the JSON:API programming interface, and since 8.x-2.25 from June 2021 for the others. Centarro and the Drupal security team say they do not believe, at this stage, that the flaw has been exploited in an automated way, or beyond the first sites reported.

The versions to install right away

• 3.x branch: upgrade to Commerce Core 3.3.13 (versions 3.0.0 to 3.3.12 are vulnerable).
• Older branches: upgrade to Commerce Core 8.x-2.41.

On the same day, security patches were released for Commerce API, Commerce License, Commerce Shipping and Commerce Stripe. According to SecurityWeek, one of them fixes a flaw that could mark Stripe orders as paid without any actual payment. Update them at the same time.

How do you know if your store was targeted?

Updating is not enough: fake orders that were already recorded remain in the database. Drupal asks site owners to “audit orders for inconsistencies.” Centarro details four checks:

1. orders that were placed but not paid, with no pending or authorized payment (excluding legitimate free orders);
2. orders marked as paid with no recorded payment, especially if your site allows changes through JSON:API;
3. abnormal prices that no promotion explains, and the “Override the unit price” option enabled for no reason;
4. discounts, fees or adjustments that no team member added.

Centarro publishes SQL queries for each of these cases. They may also surface legitimate orders, so a manual review is still necessary. The best way to confirm abuse is to match the order's IP address and time against the access logs for /checkout/ pages.

Two common-sense tips complete the list: never ship an order without checking that the payment was actually collected, and set JSON:API to read-only if you do not need to write through it.

Two weeks after other critical flaws

In mid-October, Drupal had already fixed two critical remote code execution flaws, with no known exploitation at the time. This time, the advisory reported active exploitation as soon as the patch was released. It remains to be seen whether CISA, the US cybersecurity agency, will add the flaw to its catalog of known exploited vulnerabilities. It had not done so as of October 30, according to Rescana.