SQL Injection Vulnerability in Craft Commerce E-commerce Platform by Craft CMS
CVE-2026-32271

7.7HIGH

Key Information:

Vendor

Craftcms

Status
Commerce
Vendor
CVE Published:
13 April 2026

What is CVE-2026-32271?

Craft Commerce, an e-commerce platform for Craft CMS, contains an SQL injection vulnerability in the Commerce TotalRevenue widget. This flaw impacts versions 4.0.0 to 4.10.2 and 5.0.0 to 5.5.4, enabling authenticated control panel users to exploit the issue for remote code execution through a four-step process. Unsanitized settings in the widget lead to SQL expression manipulation, combined with PDO's multi-statement query support. Attackers can inject a serialized PHP object that, when processed by the queue, utilizes an unrestricted unserialize() function to execute arbitrary code via a webshell. The vulnerability requires minimal effort, needing only three HTTP requests and no administrative privileges to trigger queue processing through an unauthenticated endpoint. The issue has been resolved in versions 4.10.3 and 5.5.5.

Affected Version(s)

commerce >= 4.0.0, < 4.10.3 < 4.0.0, 4.10.3

commerce >= 5.0.0, < 5.5.5 < 5.0.0, 5.5.5

References

https://github.com/craftcms/commerce/security/advisories/...
x_refsource_CONFIRM
https://github.com/craftcms/commerce/commit/6d2d24b3a2b0c...
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.