Drupal Commerce Core Access Bypass Actively Exploited; Stores Told to Audit Orders

Key points

• Drupal Commerce Core is affected by an access-bypass issue under active exploitation.
• Unknown attackers are targeting online stores that rely on the module.
• Merchants should review order records and related activity for signs of unauthorized access.
• No CVE identifier is listed in the available information; severity is high.

A SecurityWeek report indicates that unknown threat actors are actively taking advantage of an access-control weakness in Drupal's Commerce Core component. The issue lets unauthorized parties get around intended access restrictions, and exploitation has been observed in real-world use rather than remaining theoretical. The available information does not include a CVE identifier, so defenders should not wait for a CVE lookup to determine whether their sites may be exposed.

Online stores built on Drupal and using Commerce Core are the primary concern. Because the module supports e-commerce workflows, an access bypass can undermine the trust boundaries that normally protect order information and related administrative functions. Merchants should treat order auditing as an immediate priority: review recent order records, changes, and access patterns for anything that does not match expected staff or customer behavior.

The business risk extends beyond a single failed permission check. If unauthorized users can reach order-related data or actions, stores may face integrity problems in order processing, inaccurate records, and potential customer-confidence damage. That is why the response should combine technical review with a focused examination of order activity, especially where administrative access or order-management functions are involved.

With no CVE assigned in the facts provided and a high severity rating, the practical takeaway is to reduce exposure while investigating. Watch for vendor guidance and module updates, monitor web and application logs for unusual access attempts, and compare order records against known legitimate activity. Any confirmed anomaly should be handled as a security incident with evidence preservation and appropriate escalation.

What to do now

1. Inventory every Drupal site that runs Commerce Core and confirm which environments are internet-facing.
2. Apply available vendor updates or mitigation guidance for Commerce Core as soon as they are validated.
3. Audit recent orders for unauthorized changes, unexpected status transitions, or access by accounts that should not have order-management rights.
4. Review Drupal, web server, and application logs for access-bypass attempts or unusual order-related requests.
5. Tighten permissions for order administration and revoke stale or unnecessary accounts and sessions.
6. Preserve relevant logs and order records before making changes, and escalate suspected unauthorized access through incident-response channels.

Original source

SecurityWeek