Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-307.
Summary
Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Craft CMS | commerce | 4.0.0 to before 4.11.2; 5.0.0 to before 5.6.5 | 4.11.2, 5.6.5 | Patch available | CNA |
| — | craftcms/commerce (Packagist) | 5.0.0 to before 5.6.5 | 5.6.5 | Patch available | GHSA-h5gm-x9wr-vhcm |
| — | craftcms/commerce (Packagist) | 4.0.0 to before 4.11.2 | 4.11.2 | Patch available | GHSA-h5gm-x9wr-vhcm |
- commerce VendorCraft CMS Affected 4.0.0 to before 4.11.2; 5.0.0 to before 5.6.5 Fixed in 4.11.2, 5.6.5 Patch available CNA
- craftcms/commerce (Packagist) Vendor— Affected 5.0.0 to before 5.6.5 Fixed in 5.6.5 Patch available GHSA-h5gm-x9wr-vhcm
- craftcms/commerce (Packagist) Vendor— Affected 4.0.0 to before 4.11.2 Fixed in 4.11.2 Patch available GHSA-h5gm-x9wr-vhcm
Remediation
- Fix · CNA commerce (craftcms) Fixed in 4.11.2, 5.6.5
- Fix · GHSA-h5gm-x9wr-vhcm craftcms/commerce (Packagist) Fixed in 5.6.5 Advisory →
- Fix · GHSA-h5gm-x9wr-vhcm craftcms/commerce (Packagist) Fixed in 4.11.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55795
- 2026-10-03 Alias added: GHSA-h5gm-x9wr-vhcm
References
Other 6
- https://github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm
- https://github.com/craftcms/commerce/commit/a7d365cc33dc4c60c543defb3458bcdb5749bc13
- https://github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5
- https://github.com/craftcms/commerce/releases/tag/4.11.2
- https://github.com/craftcms/commerce/releases/tag/5.6.5
- https://github.com/craftcms/commerce
More Craft CMS vulnerabilities
- TI-2025-23503 Craft CMS Allows Remote Code Execution KEVCVSS 3.1CRITICAL 10.0
- TI-2024-37138 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms KEVCVSS 4.0CRITICAL 9.3
- TI-2025-16994 Potential RCE with a compromised security key in craft/cms KEVCVSS 3.1HIGH 8.1
- TI-2025-24595 Craft CMS stores user-provided content in session files KEVCVSS 4.0MEDIUM 6.9
- TI-2023-22284 Craft CMS Remote Code Execution vulnerability CVSS 3.1CRITICAL 10.0
- TI-2024-25171 Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-55795 · CVE Program
- CVE-2026-55795 · NVD
- FIRST EPSS
- GHSA-h5gm-x9wr-vhcm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences