What’s Vulnerable › Vulnerabilities

CVE-2026-32272: Craft Commerce: Blind SQL Injection via hasVariant/hasProduct

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-13 · updated 2026-10-26
• Weakness: CWE-89

Description

Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability exists where the ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the input sanitization blocklist added to ElementIndexesController in a prior security fix (GHSA-2453-mppf-46cj). The blocklist only strips top-level Yii2 Query properties such as where and orderBy, but hasVariant and hasProduct pass through untouched and internally call Craft::configure() on a subquery without sanitization, re-introducing SQL injection. Any authenticated control panel user can exploit this via boolean-based blind SQL injection to extract arbitrary database contents, including security keys that enable forging admin sessions for privilege escalation. This issue has been fixed in version 5.6.0.

Affected products

• craftcms commerce: from 5.0.0 < 5.6.0

References

• https://github.com/advisories/GHSA-2453-mppf-46cj
• https://github.com/craftcms/commerce/pull/4232
• https://github.com/craftcms/commerce/releases/tag/5.6.0
• https://github.com/craftcms/commerce/security/advisories/GHSA-r54v-qq87-px5r

Get alerted when CVE-2026-32272 or the next vulnerability affects your stack