Drupal Commerce Core authorization bypass under active exploitation

Affected Systems

Drupal Commerce Core module versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Affects e-commerce sites using Commerce Core for shopping cart and checkout functionality or decoupled API-based commerce applications.

Exploitation Status

Active exploitation confirmed by Drupal. No details provided on campaign scope, attacker identity, or exploitation methods. No public PoC mentioned in advisory.

Business Impact

Authorization bypass allows attackers to access protected routes and entity fields in Commerce Core, potentially leading to financial loss for vendors. Direct impact on revenue-generating e-commerce operations. CVSS score not yet published. Exploitation difficulty unknown, but active use in the wild indicates accessible attack surface.

Urgency

🔴 Immediate

Recommended Actions

• Immediately upgrade Drupal Commerce Core 3.x installations to version 3.3.13
• Immediately upgrade Drupal Commerce Core 8.x-2.x installations to version 8.x-2.41
• Review Commerce Core access logs and Drupal watchdog logs for unauthorized access to checkout, cart, or order management routes since vulnerability disclosure
• Audit recent order modifications, pricing changes, and payment transactions for anomalies that could indicate exploitation
• If immediate patching is not possible, consider temporarily disabling Commerce Core functionality or restricting access to e-commerce routes via web application firewall rules until patching is complete