Commerce Core 3.3.13 and 8.x-2.41 Patch Vulnerability Allowing Fraudulent Orders
Centarro released patches for Commerce Core to fix a vulnerability exploited to create fraudulent orders, urging users to audit production sites for anomalies.
Commerce Core 3.3.13 and 8.x-2.41 patch a vulnerability tracked as SA-CONTRIB-2026-254 that attackers have used to place fraudulent orders on live stores. Centarro and the Drupal Security Team released the patches on October 28, 2026, after receiving two reports from merchants who saw suspicious activity on production sites. Maintainers do not currently believe the flaw was exploited beyond the initial sites, though the issue affects both full-stack and headless installations with different attack vectors.
Exploitation has been theoretically possible since Commerce Core 8.x-2.18, released May 26, 2020, on sites using the JSON:API module, and since 8.x-2.25, released June 30, 2021, for all other sites. Security releases also shipped for Commerce API, Commerce License, Commerce Shipping, and Commerce Stripe, and you should update these at the same time. If your site does not need update operations through JSON:API, switch it back to read-only.
Maintainers recommend reviewing recent orders for four patterns: unpaid orders with no pending payment, paid orders with no associated payment entities, product prices unexplained by promotions, and unauthorized discounts or fees. Reportedly, orders included $0.01 prices, enabled unit price overrides, and unfamiliar adjustments. The advisory provides four SQL queries to find suspicious orders, but results require manual review against access logs where legitimate orders use paths beginning with /checkout/.