Drupal Commerce Core CVE-2026-118539 (SA-CONTRIB-2026-254, highly critical access bypass, exploited in the wild): which versions fix it and how do I check orders for tampering?

What it is: On October 28, 2026 the Drupal Security Team published SA-CONTRIB-2026-254 for Commerce Core (the commerce module), rated Highly critical (21/25). The module didn't sufficiently protect certain routes and entity fields, so an unauthenticated visitor could reach or change data they shouldn't, with possible financial impact on the store. The advisory states the flaw is being actively exploited in the wild. It's tracked as CVE-2026-118539. Am I affected: - Drupal sites running Commerce Core 3.x before 3.3.13, or the older 8.x-2.x branch before 8.x-2.41. - Check the installed version with composer show drupal/commerce, drush pm:list | grep commerce, or the Available updates report (Reports > Available updates). - The risk is real only on sites with Commerce enabled and publicly reachable. Fix: 1. Update now: composer update drupal/commerce --with-dependencies to 3.3.13 or later (or 8.x-2.41 on the old branch), then run database updates (drush updb) and clear caches (drush cr). Deploy to production promptly; this is exploited. 2. Audit orders, as the advisory recommends: look for orders whose totals, prices, adjustments or payment state don't match the payments your gateway actually received; orders placed or changed by anonymous users in unusual ways; and changes to order items after checkout. Compare against your payment provider's records before shipping or fulfilling. 3. Review site logs (watchdog / web server logs) around suspicious orders, and check for new admin users or configuration changes as general hygiene. 4. If you find manipulated orders, cancel or correct them, contact affected customers if needed, and keep evidence. Verify: composer show drupal/commerce reports 3.3.13+ (or 8.x-2.41+), the Available updates report no longer flags a security update for Commerce, and your order audit is complete. Sources: https://www.drupal.org/sa-contrib-2026-254 https://github.com/advisories/GHSA-372m-625x-8m53 https://nvd.nist.gov/vuln/detail/CVE-2026-118539