Drupal Commerce vulnerability: orders marked “paid” with no money coming in
An order comes in on your online store. It’s marked “paid”, the packing slip prints, the team packs and ships. Except the money never came in. Or: the customer paid $0.01 for a product worth hundreds.
That is the kind of fraud made possible by a flaw in Drupal Commerce, Drupal’s e-commerce module. The Drupal security team rated it “highly critical” on October 28, 2026 and confirms it is being exploited. Here is who is affected, what to update and, above all, which orders to check.
Drupal Commerce vulnerability: the essentials
🛒
The affected module
Commerce Core, the cart and checkout of Drupal Commerce. Not Drupal core itself.
🔓
The problem
Some routes and fields are not protected enough (CVE-2026-118539). According to Drupal’s advisory, no login is needed.
💸
The impact
Orders can be placed without payment, wrongly marked as paid, or with an altered price.
✅
The fix
Commerce Core 3.3.13 (3.x branch) or 8.x-2.41 (older branches), released October 28, 2026.
Centarro, the company that maintains Drupal Commerce, says it received two reports from merchants who saw attempted fraudulent orders on their live sites. As of now, it does not believe the exploitation was scripted or spread beyond those sites. But because merchants, not researchers, spotted the problem, it recommends every user review their recent orders.
According to Centarro, the issue existed since version 8.x-2.18 (May 2020) on sites using JSON:API, and since 8.x-2.25 (June 2021) for others. Both traditional and headless (decoupled) stores are affected.
The 4 types of orders to check
Placed, not paid 1
Order placed with no pending or authorized payment
Status: placed · Balance due
🤖 Payment may have been bypassed at checkout. Check it if you sell nothing for free.
Paid with no payment 1
Marked paid, but no payment recorded
Mainly if JSON:API allows writes
🤖 Payment may have been simulated with no real money.
Odd price 1
Unit price overridden, e.g. $0.01
No promotion explains it
🤖 The price may have been changed before checkout.
Unexplained discount 1
Discount, fee or adjustment added
Nobody on the team added it
🤖 An adjustment field may have been altered.
Note: according to The DropTimes, some fraudulent orders had a perfectly normal price. The total alone isn’t enough. Centarro published four SQL queries to find these cases and recommends comparing the time and IP address of suspicious orders with the site’s access logs. These queries can also return legitimate orders, such as those created by your staff.
The action plan for your store
In order
Today
Update Commerce Core
Version 3.3.13 or 8.x-2.41, after a full backup of the site and database.
Today
Update related modules
Centarro released same-day security updates for Commerce API, Commerce License, Commerce Shipping and Commerce Stripe, if you use them.
This week
Restrict JSON:API
If your site doesn’t need to write data through JSON:API, make it read-only.
This week
Audit orders
The four types above, going back as far as possible, then compare with the payments received at your payment processor.
Then
Decide on each suspicious order
Hold the shipment, cancel or contact the customer, and document what you found.
Is your store on another platform? The same reflex applies: we covered the case of Magento and the Blockstrap flaw. The key is to regularly reconcile orders marked paid with the money actually received.
How NeoTech can help
Our cybersecurity services cover your site updates, a review of installed modules and help auditing suspicious orders. Our automated 24/7 monitoring with on-call technician intervention can be added to the servers we manage.
Book your free cyber check
In 30 minutes, we look together at your online store, its modules and how to spot an order that was never paid.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Drupal Security Team — Commerce Core, Highly critical, Access bypass, SA-CONTRIB-2026-254, October 28, 2026
- Centarro — Update Drupal Commerce sites for an exploit observed in the wild
- BleepingComputer — Drupal warns of critical Commerce Core flaw exploited in attacks, October 30, 2026
- The DropTimes — Centarro Publishes Order-Audit Checks After Drupal Commerce Exploit Reports
Photo: Cup of Couple, Pexels (Pexels licence).