Read the docs
TI-2026-24800 Aliases CVE-2026-32271GHSA-875v-7m49-8x88

Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget

Priority LOW 36CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, there is an SQL injection vulnerability in the Commerce TotalRevenue widget which allows any authenticated control panel user to achieve remote code execution through a four-step exploitation chain. The attack exploits unsanitized widget settings interpolated into SQL expressions, combined with PDO's default multi-statement query support, to inject a maliciously serialized PHP object into the queue table. When the queue consumer processes the injected job, the unrestricted unserialize() call in yii2-queue instantiates a GuzzleHttp FileCookieJar gadget chain whose __destruct() method writes a PHP webshell to the server's webroot. The complete chain requires only three HTTP requests, no administrative privileges, and results in arbitrary command execution as the PHP process user, with queue processing triggered via an unauthenticated endpoint. This issue has been fixed in versions 4.10.3 and 5.5.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00476 41st percentileScored 2026-11-07
Fix Fixed commerce (craftcms): 4.10.3, 5.5.5craftcms/commerce (Packagist): 4.10.3, 5.5.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Craft CMScommerce4.0.0 to before 4.10.3; 5.0.0 to before 5.5.54.10.3, 5.5.5Patch availableCNA
—craftcms/commerce (Packagist)4.0.0 to before 4.10.34.10.3Patch availableGHSA-875v-7m49-8x88
—craftcms/commerce (Packagist)5.0.0 to before 5.5.55.5.5Patch availableGHSA-875v-7m49-8x88
  • commerce VendorCraft CMS Affected 4.0.0 to before 4.10.3; 5.0.0 to before 5.5.5 Fixed in 4.10.3, 5.5.5 Patch available CNA
  • craftcms/commerce (Packagist) Vendor— Affected 4.0.0 to before 4.10.3 Fixed in 4.10.3 Patch available GHSA-875v-7m49-8x88
  • craftcms/commerce (Packagist) Vendor— Affected 5.0.0 to before 5.5.5 Fixed in 5.5.5 Patch available GHSA-875v-7m49-8x88

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:*:*:*——Craft CMS
  • cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:*:*:* Versions — — ·Craft CMS

Remediation

  • Fix · CNA commerce (craftcms) Fixed in 4.10.3, 5.5.5
  • Fix · GHSA-875v-7m49-8x88 craftcms/commerce (Packagist) Fixed in 4.10.3 Advisory →
  • Fix · GHSA-875v-7m49-8x88 craftcms/commerce (Packagist) Fixed in 5.5.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32271
  2. 2026-10-03 Alias added: GHSA-875v-7m49-8x88

References

Advisory 1

Other 3

  • TI-2025-23503 Craft CMS Allows Remote Code Execution KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-37138 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms KEVCVSS 4.0CRITICAL 9.3
  • TI-2025-16994 Potential RCE with a compromised security key in craft/cms KEVCVSS 3.1HIGH 8.1
  • TI-2025-24595 Craft CMS stores user-provided content in session files KEVCVSS 4.0MEDIUM 6.9
  • TI-2023-22284 Craft CMS Remote Code Execution vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2024-25171 Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. CVSS 3.1CRITICAL 9.8
See all 203 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences