CVE-2026-32271 craftcms CVE debrief

Who should care

Defenders responsible for Craft Commerce installations, especially those with exposed systems, should assess their exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-32271 is a high-severity SQL injection vulnerability in Craft Commerce's TotalRevenue widget, allowing remote code execution. Defenders should prioritize patching or mitigating this vulnerability, especially in environments with exposed Craft Commerce installations, as it could lead to arbitrary command execution and compromise of systems.

• Remote code execution as the PHP process user
• Potential for arbitrary command execution
• Possible exploitation via unauthenticated endpoints
• Verification of patching and system integrity required

Technical summary

The vulnerability is caused by unsanitized widget settings interpolated into SQL expressions in the Commerce TotalRevenue widget. This allows authenticated control panel users to inject maliciously serialized PHP objects into the queue table, leading to remote code execution when the queue consumer processes the injected job. The attack exploits unsanitized widget settings interpolated into SQL expressions, combined with PDO's default multi-statement query support, to inject a maliciously serialized PHP object into the queue table.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments with exposed Craft Commerce installations.

Recommended defensive actions

• Patch Craft Commerce installations to versions 4.10.3 or 5.5.5
• Restrict access to the Craft Commerce control panel
• Monitor for suspicious activity on Craft Commerce systems
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and fixed versions. However, additional information on potential exploitation or affected systems is limited. Defenders should verify patching and system integrity, review compensating controls for exposed systems, and monitor for suspicious activity on Craft Commerce systems. The CVE record was published on 2026-04-13T21:16:24.260Z and has not been modified since then. There are no known ransomware campaign uses or specific vendor project/product details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.