Loading...
Skip to main content
GeekWala

CVE-2026-32272 — Vulnerability in craftcms/commerce — CVE Details

HIGH

Craft Commerce hasVariant/hasProduct Blind SQL Injection

Published April 14, 2026Updated July 8, 2026Source: osv

Summary

## Overview Craft Commerce’s `ProductQuery::hasVariant` and `VariantQuery::hasProduct` properties bypass the `unset()` blocklist added to `ElementIndexesController` in GHSA-2453-mppf-46cj. The blocklist only strips top-level Yii2 Query properties (`where`, `orderBy`, etc.), but `hasVariant` and `hasProduct` pass through untouched. Internally, these properties call `Craft::configure()` on a subquery without sanitization, re-introducing SQL injection via `criteria[hasVariant][where]=INJECTED_SQL`. An authenticated control panel user can perform boolean-based blind SQL injection through the patched `ElementIndexesController` and extract arbitrary database contents. ## Impact * Full database read access via blind SQL injection * Privilege escalation via security key extraction → forged admin sessions ## Prerequisites * Authenticated control panel user * Commerce plugin installed * Products with variants in the database

Advisory Timeline

  • First published April 14, 2026 (181 days ago).
  • Last revised July 8, 2026 — 85 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update craftcms/commerce to 5.6.0 or later
composer require "craftcms/commerce:^5.6.0"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
craftcms/commerce
packagist
5.0.0, 5.0.1, 5.0.10, 5.0.10.1 (+85 more)5.6.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-32272?
Craft Commerce hasVariant/hasProduct Blind SQL Injection This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-32272?
CVE-2026-32272 affects craftcms/commerce. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-32272 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-r54v-qq87-px5r

Related CVEs

  • CVE-2026-32271
    HIGH

    Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget

  • CVE-2026-29172
    HIGH

    Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting

  • CVE-2026-29174
    HIGH

    Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting

  • CVE-2026-65954
    HIGH

    PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

  • CVE-2026-61825
    HIGH

    code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

  • CVE-2026-25482
    MEDIUM

    Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

More Packagist advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies