CVE-2026-32271: Craft Commerce SQL Injection RCE Flaw

CVE-2026-32271 Overview

CVE-2026-32271 is a critical SQL injection vulnerability affecting Craft Commerce, the ecommerce platform for Craft CMS. This vulnerability allows any authenticated control panel user to achieve remote code execution through a sophisticated four-step exploitation chain that leverages unsanitized widget settings, PDO multi-statement query support, and insecure deserialization.

The attack is particularly dangerous because it requires only three HTTP requests to execute, does not require administrative privileges, and results in arbitrary command execution as the PHP process user. Queue processing can be triggered via an unauthenticated endpoint, making this a highly exploitable vulnerability.

Critical Impact

Authenticated attackers can achieve full remote code execution through SQL injection chained with insecure deserialization, resulting in complete server compromise with minimal effort.

Affected Products

• Craft Commerce versions 4.0.0 through 4.10.2
• Craft Commerce versions 5.0.0 through 5.5.4

Discovery Timeline

• April 13, 2026 - CVE-2026-32271 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32271

Vulnerability Analysis

This vulnerability resides in the Commerce TotalRevenue widget component of Craft Commerce. The flaw stems from improper handling of user-controlled input that gets interpolated directly into SQL expressions without adequate sanitization. What makes this vulnerability particularly severe is the multi-stage exploitation chain it enables.

The attack exploits a combination of weaknesses: first, the unsanitized widget settings allow SQL injection. This is then combined with PDO's default support for multi-statement queries, enabling the attacker to inject a maliciously crafted serialized PHP object directly into the queue table. When the queue consumer processes this injected job, the yii2-queue component's unrestricted unserialize() call instantiates a GuzzleHttp FileCookieJar gadget chain. The __destruct() method of this gadget chain writes a PHP webshell to the server's webroot, completing the RCE chain.

The complete attack requires only low-privileged access (any authenticated control panel user) and can be executed with just three HTTP requests. The queue processing can be initiated through an unauthenticated endpoint, removing the need for continued authenticated access after the initial injection.

Root Cause

The root cause of CVE-2026-32271 is improper input validation in the Commerce TotalRevenue widget. Widget settings provided by authenticated users are directly interpolated into SQL query expressions without proper sanitization or parameterization. This is compounded by the insecure deserialization practices in the yii2-queue component, which performs unrestricted unserialize() operations on data stored in the queue table, allowing object injection attacks.

Attack Vector

The attack is network-based and requires authenticated access to the Craft CMS control panel, though only minimal privileges are needed. The exploitation chain proceeds as follows:

1. An authenticated user with access to the control panel configures a TotalRevenue widget with malicious settings containing SQL injection payloads
2. The SQL injection leverages PDO's multi-statement query capability to insert a serialized PHP object into the queue table
3. The serialized object contains a GuzzleHttp FileCookieJar gadget chain crafted to write arbitrary files
4. Queue processing (triggered via an unauthenticated endpoint) deserializes the malicious object
5. The gadget chain's __destruct() method executes, writing a PHP webshell to the webroot
6. The attacker accesses the webshell to execute arbitrary commands as the PHP process user

The attack mechanism exploits the dangerous combination of SQL injection and insecure deserialization (CWE-89 combined with gadget chain exploitation). For detailed technical information about the vulnerability and the specific code changes in the fix, see the GitHub Security Advisory.

Detection Methods for CVE-2026-32271

Indicators of Compromise

• Unexpected PHP files appearing in the webroot directory, particularly files with suspicious names or recently created timestamps
• Anomalous entries in the queue table containing serialized PHP objects with GuzzleHttp\Cookie\FileCookieJar references
• Unusual SQL query patterns in database logs, especially multi-statement queries originating from widget configuration endpoints
• Web server access logs showing requests to previously non-existent PHP files in the webroot

Detection Strategies

• Monitor database query logs for SQL injection patterns, particularly multi-statement queries and INSERT operations targeting the queue table
• Implement file integrity monitoring on the webroot directory to detect unauthorized file creation
• Analyze application logs for anomalous widget configuration requests from non-administrative users
• Deploy web application firewall (WAF) rules to detect SQL injection attempts in widget-related endpoints

Monitoring Recommendations

• Enable verbose logging for Craft CMS control panel actions, particularly widget configuration changes
• Configure alerts for new file creation events within the web application directory structure
• Monitor queue processing logs for deserialization errors or unexpected object instantiation
• Implement baseline analysis for normal queue table contents and alert on anomalies

How to Mitigate CVE-2026-32271

Immediate Actions Required

• Upgrade Craft Commerce to version 4.10.3 or 5.5.5 immediately
• Audit the queue table for any suspicious serialized objects, particularly those referencing GuzzleHttp\Cookie\FileCookieJar
• Perform a file integrity check on the webroot to identify any unauthorized PHP files
• Review access logs for evidence of exploitation attempts against widget configuration endpoints
• Temporarily restrict control panel access to trusted administrators only until patching is complete

Patch Information

The vulnerability has been patched in Craft Commerce versions 4.10.3 and 5.5.5. The fix addresses the SQL injection vulnerability in the TotalRevenue widget by properly sanitizing widget settings before they are interpolated into SQL expressions. For technical details about the patch, see the commit on GitHub.

Organizations should prioritize this update as the vulnerability enables full remote code execution with minimal prerequisites. Review the GitHub Security Advisory GHSA-875v-7m49-8x88 for additional guidance.

Workarounds

• Restrict control panel access to only trusted users with verified business requirements until patching is completed
• Implement WAF rules to filter SQL injection patterns in requests to widget configuration endpoints
• Disable or restrict the TotalRevenue widget functionality if not critical to business operations
• Consider disabling queue processing via the unauthenticated endpoint if operationally feasible
• Apply network-level access controls to limit control panel access to trusted IP ranges

# Verify current Craft Commerce version
./craft commerce/about

# Update Craft Commerce via Composer
composer require craftcms/commerce:^4.10.3
# or for version 5.x
composer require craftcms/commerce:^5.5.5

# Clear caches after update
./craft clear-caches/all