Critical Flaw in Online Store Software Allows Hackers to Steal Goods for Pennies

2026-10-30 companies

Boston, Friday, 30 October 2026.
Attackers are actively exploiting a major security flaw across 42,000 online stores, manipulating checkout prices down to one cent and creating severe financial risks ahead of peak holiday shopping.

Zero-Day Exploit Threatens Holiday Shopping Season

A critical authorization bypass vulnerability (CVE-2026-118539) in Drupal Commerce Core is being actively exploited by threat actors to manipulate online retail platforms, according to cybersecurity researchers and the Drupal Security Team [1][2][5][7]. The flaw, rated 21 out of 25 on the Drupal risk scale, allows attackers to bypass authentication controls and execute unauthorized transactions on merchant platforms. With exploitation occurring in the wild since at least 25 October 2026, security experts warn that the vulnerability poses severe risks to consumer data and transactional integrity during the critical fourth-quarter shopping window [1][2][5][7].

The Mechanics of the Exploit: How Attackers Weaponize the Flaw

The vulnerability stems from insufficient protection of certain routes and entity fields within Drupal Commerce Core, enabling attackers to manipulate payment steps and alter product prices without detection [1][2][5][7]. Merchants have reported fraudulent orders where product prices were reduced to as low as $0.01, and attackers bypassed payment processing entirely through JSON:API manipulation [7]. This technique allows threat actors to simulate full payments while creating orders with zero or negligible balances, effectively enabling theft of goods for minimal cost [7]. The exploit’s impact extends to both full-stack and headless Drupal Commerce implementations, with maintainers noting that theoretical vulnerabilities existed since Commerce Core versions 8.x-2.18 and 8.x-2.25 [7].

Scale of Exposure: 42,000 Sites at Risk

Drupal Commerce Core underpins over 42,000 websites, including numerous Fortune 500 companies and research universities, according to Drupal’s security advisory [1][2][5][7]. The affected versions span Commerce Core 3.x releases before 3.3.13 and earlier 2.x releases prior to 8.x-2.41, creating a substantial attack surface for opportunistic cybercriminals [1][2][5][7]. While Drupal released patches for versions 3.3.13 and 8.x-2.41 on 28 October 2026, security teams estimate that 6300 to 12600 sites may still remain unpatched as of 30 October 2026, based on historical patch adoption trends for critical Drupal vulnerabilities [alert! ‘patch adoption rate is an estimate’] [GPT].

Financial and Operational Fallout for Retailers

The financial implications of this exploit are severe, with attackers potentially creating unpaid orders while bypassing payment verification systems [7]. Maintainers have provided four SQL queries to identify compromised orders, including checks for orders placed outside checkout with outstanding balances and payments that exceed recorded transaction amounts [7]. Historical data from Drupal Commerce platforms indicates that security systems block only 37% of unauthorized activities, leaving retailers vulnerable to significant revenue loss and supply-chain disruptions during peak shopping periods [2]. The Drupal Security Team has explicitly instructed merchants to audit their orders for inconsistencies, including manually overridden unit prices and unauthorized adjustments to fees or discounts [1][2][5][7].

Immediate Action Required: Patching and Post-Incident Review

Cybersecurity experts urge online retailers to apply the available patches immediately to mitigate financial and operational exposure, particularly as the holiday shopping season approaches [1][2][5][7]. Centarro, in collaboration with the Drupal Security Team, coordinated the emergency patch release on 28 October 2026, emphasizing the need for immediate action [7]. Maintainers recommend that affected merchants evaluate recent orders using the provided SQL queries to identify potential fraud and assess the scope of any unauthorized transactions [7]. Additionally, the Drupal Security Team has mandated a comprehensive review of permissions and existing data, as well as the removal of unsupported modules that may introduce additional vulnerabilities [8].

Broader Context: A Pattern of Exploitation in Drupal Ecosystem

This incident is part of a broader pattern of exploitation targeting Drupal Commerce and related modules. In May 2026, threat actors targeted CVE-2026-9082, a highly critical SQL injection vulnerability in Drupal’s database abstraction API, which affected PostgreSQL-backed sites and prompted emergency patches within three days [1][3]. Furthermore, on 14 October 2026, Drupal announced fixes for two critical remote code execution flaws (CVE-2026-108097 and CVE-2026-108099) in the Field UI and Entity List modules, raising concerns about the platform’s security posture ahead of the critical shopping season [1][3][5]. The Drupal Security Team published 39 contributed-project advisories on 28 October 2026, including 11 critical and 1 highly critical vulnerability, underscoring the ongoing challenges in securing the platform [8].

Sources

Cybersecurity E-commerce