Drupal AlternativeCommerce CVE-2026-9726

The vulnerable AlternativeCommerce (Basket) contrib module must be installed and enabled on a Drupal site running an affected version (0.0.0 through 2.1.16). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required - remote unauthenticated exploitation is possible against sites where the module is active. The primary limiting factor is deployment: only Drupal installations that have specifically added this niche commerce module are exposed, and practical object-injection exploitation additionally depends on a reachable PHP gadget chain (POP chain) in the loaded codebase, which is not guaranteed by the CVE data alone and should be verified against the vendor advisory. No non-default configuration setting is named in the description as a prerequisite.

The signals are partially conflicting and warrant nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) describes an easy, remote, unauthenticated attack with full confidentiality, integrity, and availability impact - the theoretical worst case for a web module. However, the EPSS probability is only 0.16% (6th percentile), it is NOT on the CISA KEV list, and no public exploit code was identified, so real-world exploitation is currently unproven and likely constrained by the module's limited deployment footprint. Object-injection flaws also frequently depend on the presence of a usable gadget chain, which can make practical RCE harder than the raw AC:L metric implies - verify against the vendor advisory whether a working chain is confirmed. Net assessment: patch promptly because a fix exists and the flaw class is dangerous, but this is a lower operational priority than a KEV-listed or widely-deployed critical, and its real risk is bounded by prevalence rather than by attack difficulty.

A remote, unauthenticated attacker sends a crafted HTTP request to a Drupal site running a vulnerable AlternativeCommerce (Basket) module, embedding a malicious serialized PHP object into a parameter the module deserializes or uses to populate object attributes. When the module processes the input, the injected object triggers a property-oriented gadget chain in the loaded PHP code, allowing the attacker to tamper with application state or execute code. No public proof-of-concept was identified at time of analysis, and the low attack complexity (AC:L) means a working exploit would be straightforward to reuse once a gadget chain is established.