PT-2026-32516 · Craft Cms · Craft Commerce

Neosprings · Published 2026-04-13 · Updated 2026-04-14 · CVE-2026-32272

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft Commerce versions prior to 5.6.0

Description An SQL injection exists in the ecommerce platform for Craft CMS. The hasVariant property of ProductQuery and the hasProduct property of VariantQuery bypass the input sanitization blocklist in ElementIndexesController. These properties internally call the (Craft::configure()) function on a subquery without sanitization. Authenticated control panel users can exploit this via boolean-based blind SQL injection to extract arbitrary database contents, including security keys that enable forging admin sessions for privilege escalation.

Recommendations Update to version 5.6.0. As a temporary workaround, avoid using the hasVariant and hasProduct properties in queries until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-32272

GHSA-R54V-QQ87-PX5R

Affected Products

Craft Commerce

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-32272 · Security Note
• https://osv.dev/vulnerability/GHSA-r54v-qq87-px5r · Vendor Advisory
• https://github.com/craftcms/commerce · Note
• https://github.com/craftcms/commerce/pull/4232 · Note
• https://github.com/craftcms/commerce/security/advisories/GHSA-r54v-qq87-px5r · Note
• https://github.com/craftcms/commerce/releases/tag/5.6.0 · Note
• https://github.com/advisories/GHSA-2453-mppf-46cj · Note
• https://twitter.com/CVEnew/status/2043976204424794622 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043895996002730139 · Twitter Post