Drupal Commerce vulnerability: orders marked “paid” with no money coming in
A Drupal Commerce flaw (CVE-2026-118539), exploited according to Drupal, lets attackers place orders without paying or at an altered price. The versions to install and the 4 types of orders to check in your store.









