Centarro Publishes Order-Audit Checks After Drupal Commerce Exploit Reports

Maintainers of Drupal Commerce have published four SQL queries to help merchants identify potentially manipulated orders after receiving two reports of attempted exploitation on live websites. In a 29 October 2026 blog post, Ryan Szrama, Drupal Commerce project lead at Centarro, said the reports came from merchants who observed suspicious activity rather than researchers testing the platform. Centarro published the guidance in consultation with the Drupal Security Team following security updates released on 28 October 2026.

The guidance provides specific investigation criteria following the Highly Critical access-bypass advisory, SA-CONTRIB-2026-254, which confirmed active exploitation of Commerce Core vulnerability CVE-2026-118539. The flaw involves insufficient protection on certain routes and entity fields, potentially allowing unauthorised changes with financial consequences for merchants. It affects both conventional Drupal Commerce websites and headless implementations, although the attack paths differ. Centarro said it had investigated the possibility of broader abuse with the Drupal Security Team and did not believe the exploitation was scripted or extended beyond the initially reported sites. That assessment does not establish how many websites may have been exposed or whether additional incidents went undetected.

Centarro advises merchants to investigate orders placed without payment, particularly those with no pending or authorised payments, as well as orders that appear paid without corresponding payment records. The latter scenario is especially relevant to sites that permit updates to Commerce data through Drupal's JSON:API module. Merchants are also advised to examine unexpected product prices, overridden unit prices and adjustments that cannot be explained by legitimate promotions or staff actions. The reported attempts included orders with unusually low prices, such as $0.01, and orders with normal prices, meaning suspicious transactions may not always be identifiable from their totals alone.

Centarro's assessment also places the potential exposure several years before the October disclosure. According to Szrama, the vulnerability was theoretically exploitable from Commerce Core 8.x-2.18, released on 26 May 2020, when used with JSON:API, and from version 8.x-2.25, released on 30 June 2021, for other implementations. These dates identify when exploitation may have become technically possible under the relevant configurations, not when attacks were first observed. The maintainer's findings do not establish that malicious activity occurred throughout that period.

To support investigations, Centarro published four SQL queries designed to identify orders placed outside the normal checkout process with an outstanding balance, orders whose recorded paid totals exceed completed payments, overridden unit prices and manually added adjustments. Szrama cautioned that the queries can return legitimate transactions, including staff-created orders, authorised price overrides and orders processed through custom workflows. Some manipulated orders may also escape detection, particularly when later payments alter the recorded totals or when an attacker changes a price and completes checkout normally. Centarro recommends comparing order timestamps and IP addresses with website access logs to determine whether transactions followed the expected checkout process.

The guidance also addresses a distinction in Drupal Commerce's order-processing model: completing checkout does not necessarily confirm that payment has been received. Centarro explained that checkout completion prepares an order for fulfilment, while payment and other order details must be verified before goods or services are delivered. This makes payment verification important even when an order appears to have completed checkout successfully. The published checks are intended to identify transactions requiring further examination, rather than establish fraud from individual database matches.

Centarro recommends upgrading immediately to Commerce Core 3.3.13 or 8.x-2.41, depending on the installed version, and reviewing orders for inconsistencies. It also advises operators to apply related security releases for Commerce API, Commerce License, Commerce Shipping and Commerce Stripe where those modules are used. Sites that do not require write access through JSON:API are advised to restrict it to read-only operations, alongside applying the security updates. The DropTimes previously reported the active exploitation of the Commerce Core vulnerability as part of the 39 Drupal contributed-project security advisories issued on 28 October 2026.