CVE-2026-32272 Details
Description
Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability exists where the ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the input sanitization blocklist added to ElementIndexesController in a prior security fix (GHSA-2453-mppf-46cj). The blocklist only strips top-level Yii2 Query properties such as where and orderBy, but hasVariant and hasProduct pass through untouched and internally call Craft::configure() on a subquery without sanitization, re-introducing SQL injection. Any authenticated control panel user can exploit this via boolean-based blind SQL injection to extract arbitrary database contents, including security keys that enable forging admin sessions for privilege escalation. This issue has been fixed in version 5.6.0.
A SQL injection vulnerability has been identified in Craft Commerce versions 5.0.0 prior to 5.6.0. The issue arises in the 'element-indexes/get-elements' endpoint, where the 'criteria[orderBy]' parameter is not properly sanitized before being used in database queries. This vulnerability allows authenticated control panel users to inject arbitrary SQL, particularly into the 'ORDER BY' clause, exploiting boolean-based blind SQL injection. As a result, attackers could extract sensitive database information, including security keys that could be used to forge admin sessions for privilege escalation.
Users can upgrade to Craft Commerce version 5.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 13, 2026CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/advisories/GHSA-2453-mppf-46cj | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/craftcms/commerce/pull/4232 | [email protected] | Source CodeVendor |
| https://github.com/craftcms/commerce/releases/tag/5.6.0 | [email protected] | Release NotesVendor |
| https://github.com/craftcms/commerce/security/advisories/GHSA-r54v-qq87-px5r | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Craft Commerce | All versions |
CPE
Remediation
| |
| Craft CMS | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | New CVE Received | [email protected] |