Drupal Checkout Bypass Under Active Exploitation
Drupal Checkout Bypass Under Active Exploitation
Drupal says attackers are exploiting CVE-2026-118539, an authorization bypass in Commerce Core that may let unauthenticated users alter store orders. Upgrade to 3.3.13 or 8.x-2.41 and audit orders for inconsistencies.
Don't miss what's next. Subscribe to The Daily Cyber: