PT-2026-32515 · Unknown · Craft Commerce

Rajchowdhury240 + 1 · Published 2026-04-13 · Updated 2026-04-14 · CVE-2026-32271

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft Commerce versions prior to 4.10.3 Craft Commerce versions prior to 5.5.5

Description An SQL injection exists in the Commerce TotalRevenue widget. This allows authenticated control panel users to achieve remote code execution through a four-step chain. The issue occurs when unsanitized widget settings are interpolated into SQL expressions, utilizing PDO's default multi-statement query support to inject a serialized PHP object into the queue table. When the queue consumer processes the job, an unrestricted unserialize() call in yii2-queue instantiates a GuzzleHttp FileCookieJar gadget chain, where the destruct() method writes a PHP webshell to the server's webroot. Queue processing is triggered via an unauthenticated endpoint.

Recommendations Update to version 4.10.3. Update to version 5.5.5.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-32271

GHSA-875V-7M49-8X88

Affected Products

Craft Commerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-32271 · Security Note
• https://osv.dev/vulnerability/GHSA-875v-7m49-8x88 · Vendor Advisory
• https://github.com/craftcms/commerce · Note
• https://github.com/craftcms/commerce/commit/6d2d24b3a2b0c06593856d05446f82bd8af92d72 · Note
• https://github.com/craftcms/commerce/security/advisories/GHSA-875v-7m49-8x88 · Note
• https://twitter.com/VulmonFeeds/status/2043898555492933976 · Twitter Post
• https://twitter.com/CVEnew/status/2043976205401993233 · Twitter Post