Live › vulnerability › CVE-2026-118543
Drupal Commerce Core, the e-commerce module for Drupal, has a cross-site request forgery flaw. A malicious web page could trick a logged-in user's browser into sending requests the store would accept as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which Commerce features or endpoints carry the forgeable requests, so unknown whether every store is equally exposed. Sites on versions above 2.41.0 in the 2.x line and above 3.3.13 in the 3.x line are outside the stated range.
No product ranges from the sources yet.
composer show drupal/commerceEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
This page as .md · .json · in your agent: get_signal("CVE-2026-118543")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.