Every online store dreams of customers who check out without hesitating. Fewer dream of customers who check out without paying. A newly patched hole in Drupal Commerce gave some merchants the second kind, and the Drupal Security Team is not treating it as a quirky holiday promotion.

A Penny for Your Order Totals

On October 28, the Drupal Security Team published SA-CONTRIB-2026-254 for Commerce Core, rated "Highly critical" (21 out of 25) and flagged as actively exploited in the wild. The access bypass (CVE-2026-118539) exists because the module doesn't sufficiently protect certain routes and entity fields, which the advisory says "may financially impact the vendor." The fixed versions are Commerce Core 3.3.13 and 8.x-2.41.

A day later, Centarro, the company behind Drupal Commerce, said it had received two reports of attempted fraudulent orders on live sites, some priced at $0.01. Its write-up says exploitation has been possible since 8.x-2.18 on sites using JSON:API and since 8.x-2.25 on other setups. Security releases also went out for Commerce API, Commerce License, Commerce Shipping and Commerce Stripe, and Centarro wants those updated at the same time.

Patching Closes the Door, Auditing Counts the Silverware

An update stops new abuse. It doesn't tell you who already got in. That's why the advisory tells sites to audit their orders, and Centarro's checklist is specific: orders placed with no pending or authorized payment, orders marked paid with no payment entities, suspicious product prices, and discounts or fees your staff never added. Its bluntest advice is also its best: don't fulfill an order just because checkout completed. Confirm full payment first.

The detail worth noticing is the JSON:API angle. Headless and decoupled builds are great, but every API you expose is another front door, and plenty of sites leave write operations switched on when nothing needs them. Centarro suggests making JSON:API read-only if your site doesn't need update operations, which is sound advice whether or not you sell anything.

Centarro says it doesn't believe the attacks were scripted or spread beyond the initial sites. That's reassuring for now, but the patch is public, and attackers read changelogs too.

Holiday traffic is weeks away, and nobody wants to discover in December that half of November's orders were paid in pennies.

If your store runs Drupal Commerce and you're not sure which version is live or whether last month's orders add up, our team can patch it, audit the order history and lock down JSON:API, so get in touch before Black Friday arrives.

Source: Drupal.org Security Advisory