Topic
7 articles
CyberSecureToday covers E-Commerce Security across 7 articles published between 25 Sep 2026 and 1 Nov 2026.
The coverage includes 6 vulnerability advisories and 1 analysis or guidance piece. 6 advisories are rated critical or high severity, and 2 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.
Stories on E-Commerce Security most often intersect with WordPress, WooCommerce and Authorization Bypass, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Drupal Commerce Core Critical Authorization Bypass Flaw Under Active Exploitation (CVE-2026-118539)”, was published 1 Nov 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.
CMS SecurityA highly critical authorization bypass vulnerability (CVE-2026-118539) in Drupal Commerce Core is under active exploitation, allowing order price tampering.
Threat IntelA CVSS 10.0 template injection flaw in Adobe Commerce and Magento (CVE-2026-103849) allows unauthenticated remote attackers to execute arbitrary code.
CMS SecurityJTL patches a critical arbitrary file upload vulnerability in JTL-Connector for WooCommerce (CVE-2026-87855) allowing unauthenticated web shell execution.
CMS SecurityTyche Softwares resolves a critical PHP object injection flaw in Abandoned Cart Pro for WooCommerce (CVE-2026-97657) enabling unauthenticated remote code execution.
CMS SecurityTyche Softwares resolves an unauthenticated blind SQL injection flaw in Abandoned Cart Pro (CVE-2026-97668) allowing extraction of customer and order records.
Deep DivePCI DSS v4.0.1 Requirement 6.4.3 and 11.6.1 enforcement mandates strict browser script inventory and tamper detection on all payment checkout pages.
Active ExploitAdobe and CISA warn of active exploitation targeting CVE-2026-71362 in Adobe Commerce and Magento, enabling unauthenticated manipulation of checkout orders and customer data.