Affected Systems
Drupal Commerce Core module versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Affects over 42,000 websites including Fortune 500 companies and research universities running e-commerce functionality on Drupal CMS.
Exploitation Status
Actively exploited in the wild. Drupal security team confirmed ongoing attacks targeting this vulnerability.
Business Impact
Unauthenticated attackers can bypass access controls on Commerce Core routes and entity fields, leading to unauthorized access that may result in financial loss to vendors. E-commerce sites face direct revenue impact through order manipulation or data exposure. High-profile organizations including Fortune 500 companies are at risk.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade Commerce Core 3.x branch to version 3.3.13 immediately, or upgrade 2.x branch (8.x-2.x) to version 8.x-2.41
- Audit all orders in Commerce Core for inconsistencies or unauthorized modifications that may indicate exploitation
- Review web server and application logs for suspicious access patterns to Commerce Core routes, particularly from unauthenticated sources
- Verify that only patched Commerce Core versions are deployed across all Drupal instances in the environment
- Monitor for unusual order activity, pricing changes, or checkout flow anomalies that could indicate ongoing exploitation