SQL Injection in Craftcms Commerce
CVE-2026-32272
Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability exists where the ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the input sanitization blocklis…
Vulnerability class: SQL Injection
EPSS: 0.000 (11.9th percentile) — read the EPSS interpretation.
Affected products
- Craftcms Commerce — versions >= 5.0.0 < 5.6.0
Weakness classification (CWE)
References
- https://github.com/craftcms/commerce/security/advisories/GHSA-r54v-qq87-px5r (x_refsource_CONFIRM)
- https://github.com/craftcms/commerce/pull/4232 (x_refsource_MISC)
- https://github.com/advisories/GHSA-2453-mppf-46cj (x_refsource_MISC)
- https://github.com/craftcms/commerce/releases/tag/5.6.0 (x_refsource_MISC)