CVE-2026-32272 craftcms CVE debrief

Who should care

Craft Commerce administrators and developers, especially those with authenticated control panel users, should assess exposure and prioritize patching to version 5.6.0 or later. They should also verify exposure and inventory affected instances, and monitor for suspicious database queries.

Why it matters

CVE-2026-32272 is a high-severity SQL injection vulnerability in Craft Commerce that allows authenticated control panel users to extract database contents and potentially escalate privileges. Defenders should prioritize patching to version 5.6.0 or later and verify exposure.

• Extract arbitrary database contents via boolean-based blind SQL injection
• Enable forging admin sessions for privilege escalation
• Require verification of affected versions and remediation

Technical summary

The ProductQuery::hasVariant and VariantQuery::hasProduct properties in Craft Commerce versions 5.0.0 through 5.5.4 bypass input sanitization, allowing for SQL injection attacks. This vulnerability enables authenticated control panel users to extract arbitrary database contents via boolean-based blind SQL injection, potentially leading to privilege escalation by enabling the forging of admin sessions. The issue has been fixed in version 5.6.0. Defenders should prioritize patching and verifying exposure, especially for Craft Commerce instances with authenticated control panel users.

Defensive priority

High priority for patching and verifying exposure, especially for Craft Commerce instances with authenticated control panel users.

Recommended defensive actions

• Patch Craft Commerce to version 5.6.0 or later
• Verify exposure and inventory affected instances
• Monitor for suspicious database queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the SQL injection vulnerability in Craft Commerce. The vendor has released a fix in version 5.6.0. The vulnerability allows authenticated control panel users to extract arbitrary database contents via boolean-based blind SQL injection, which could lead to privilege escalation by enabling the forging of admin sessions. Defenders should verify exposure and inventory affected instances.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.