According to Bleeping Computer, Drupal has warned administrators that a critical access‑bypass vulnerability in the Commerce Core module is being used by attackers in real‑world exploits. The advisory urges site owners to apply an available patch immediately.
The vulnerability allows unauthorized users to bypass intended access controls within the Commerce Core functionality. Drupal reports that malicious actors have already taken advantage of the issue in active attacks against sites running the affected module.
Affected installations comprise any environment where the Commerce Core module is deployed without the remediation. The patch provided by Drupal addresses the bypass and restores normal access restrictions. Site administrators are advised to verify that the update has been installed and test relevant Commerce features to confirm proper behavior.
