Drupal has warned that a highly critical vulnerability in Commerce Core is being actively exploited, with online stores urged to review their systems and audit orders. For businesses using Drupal for e-commerce, the announcement points to a direct operational and security risk rather than a theoretical software issue.

What happened

According to Drupal, the issue is a Commerce Core access bypass vulnerability. The project said the flaw is being exploited in the wild and advised store owners to audit their orders. An access bypass typically means an attacker may be able to perform actions or view data without the permissions that should normally be required.

Based on the information available from the source, Drupal has publicly signalled both the severity of the flaw and the fact that exploitation has already been observed. The warning is particularly relevant to organisations operating Drupal-based online stores.

Why it matters for European businesses

For European e-commerce businesses, a compromise affecting order workflows can create immediate commercial and compliance concerns. If attackers can interfere with commerce functions, the impact may go beyond website uptime and affect orders, customer trust, revenue operations, and internal investigations.

Even when a vulnerability is limited to a specific component rather than the full CMS, businesses can still face meaningful disruption if that component is tied to checkout, account permissions, order management, or back-office processes.

The fact that Drupal has said exploitation is already happening raises the urgency. Businesses should treat this as an incident-response and patch-management issue, especially if Drupal Commerce is connected to other systems such as payment workflows, ERP tools, fulfilment systems, CRMs, or marketing automation platforms.

Who may be affected

The primary risk applies to organisations running Drupal Commerce or stores relying on the affected Commerce Core component.

• Online retailers using Drupal-based storefronts
• SMEs with custom e-commerce sites built by agencies or internal developers
• IT and DevOps teams responsible for Drupal hosting, updates, and monitoring
• Digital agencies managing Drupal commerce environments for clients
• Businesses with integrated order-management or fulfilment workflows

Companies that are unsure whether they use the affected component should verify this quickly with their hosting provider, web agency, or internal development team.

What companies should consider

Businesses using Drupal Commerce should prioritise a structured response.

• Confirm exposure: verify whether your site uses the affected Commerce Core component and identify all production, staging, and legacy environments.
• Apply vendor guidance: review Drupal’s official security advisory and implement the recommended update or mitigation as soon as possible.
• Audit orders: follow Drupal’s recommendation to review orders for suspicious or unauthorised activity.
• Review access and logs: check application logs, admin actions, and unusual account or order behaviour for signs of misuse.
• Assess downstream systems: determine whether suspicious orders or unauthorised actions could have affected finance, fulfilment, stock, customer communications, or reporting.
• Coordinate with partners: if your store is maintained by an external agency or platform partner, confirm remediation steps and request a documented status update.
• Prepare customer and compliance workflows: if the review identifies customer-data exposure or material operational impact, assess whether internal incident procedures or regulatory notification obligations may apply.

At this stage, businesses should rely on confirmed vendor guidance and their own technical review rather than assumptions about the scope of compromise. For affected online stores, the practical priority is to patch quickly, investigate order activity, and confirm that commerce operations remain trustworthy.