CVE-2026-32272: Craft Commerce SQL Injection Vulnerability

CVE-2026-32272 Overview

Craft Commerce, an ecommerce platform for Craft CMS, contains an SQL injection vulnerability in versions 5.0.0 through 5.5.4. The vulnerability exists in the ProductQuery::hasVariant and VariantQuery::hasProduct properties, which bypass the input sanitization blocklist that was implemented in a prior security fix (GHSA-2453-mppf-46cj). The original blocklist only strips top-level Yii2 Query properties such as where and orderBy, but hasVariant and hasProduct parameters pass through untouched and internally call Craft::configure() on a subquery without proper sanitization, effectively re-introducing the SQL injection attack surface.

Critical Impact

Any authenticated control panel user can exploit this boolean-based blind SQL injection to extract arbitrary database contents, including security keys that enable forging admin sessions for privilege escalation.

Affected Products

• Craft Commerce versions 5.0.0 through 5.5.4
• Craft CMS installations using vulnerable Craft Commerce plugin versions
• Ecommerce sites with authenticated control panel users

Discovery Timeline

• April 13, 2026 - CVE-2026-32272 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32272

Vulnerability Analysis

This SQL injection vulnerability represents a security fix bypass, where the original mitigation for a prior SQL injection issue (GHSA-2453-mppf-46cj) proved insufficient. The vulnerability allows authenticated control panel users to inject malicious SQL statements through the hasVariant and hasProduct query parameters.

The attack is classified as boolean-based blind SQL injection, meaning attackers can extract database information by observing differences in application responses based on injected SQL conditions that evaluate to true or false. This technique allows methodical extraction of sensitive data including security keys, user credentials, and other confidential database contents.

The successful exploitation of this vulnerability can lead to complete database compromise and privilege escalation to administrator level through session forgery using extracted security keys.

Root Cause

The root cause lies in incomplete input sanitization. While the previous security fix added a blocklist to ElementIndexesController that strips dangerous top-level Yii2 Query properties like where and orderBy, the hasVariant and hasProduct properties were not included in this blocklist. These properties internally invoke Craft::configure() on a subquery object without applying the same sanitization logic, creating an alternative injection path that bypasses the existing security controls.

Attack Vector

The attack is network-based and requires authentication to the Craft CMS control panel. An authenticated attacker can craft requests containing malicious SQL fragments in the hasVariant or hasProduct parameters. Since these parameters are not sanitized by the blocklist, the malicious input is passed directly to Craft::configure(), which applies the attacker-controlled properties to a database subquery. Through boolean-based blind SQL injection techniques, the attacker can systematically extract arbitrary data from the database by observing response differences, ultimately obtaining security keys that can be used to forge administrative sessions.

Detection Methods for CVE-2026-32272

Indicators of Compromise

• Unusual or malformed requests to product or variant query endpoints containing hasVariant or hasProduct parameters with SQL-like syntax
• Database query logs showing unexpected subqueries or conditional statements within product/variant queries
• Abnormal access patterns to the control panel from authenticated users, especially repeated similar requests with slight variations
• Evidence of security key extraction or unauthorized admin session creation

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection patterns in hasVariant and hasProduct parameters
• Implement database activity monitoring to detect unusual query patterns or data extraction attempts
• Review Craft CMS access logs for suspicious parameter patterns in product and variant query endpoints
• Audit control panel user activity for anomalous behavior patterns

Monitoring Recommendations

• Enable detailed logging for all control panel API requests, particularly those involving product and variant queries
• Configure alerting for database queries containing unexpected SQL keywords in product/variant contexts
• Monitor for new admin sessions or privilege escalations that cannot be correlated with legitimate administrative actions
• Implement rate limiting and anomaly detection for control panel query endpoints

How to Mitigate CVE-2026-32272

Immediate Actions Required

• Upgrade Craft Commerce to version 5.6.0 or later immediately
• Audit control panel user accounts and revoke access for any suspicious or unnecessary accounts
• Review database access logs for signs of exploitation and investigate any anomalies
• Rotate security keys and admin credentials if exploitation is suspected

Patch Information

This vulnerability has been fixed in Craft Commerce version 5.6.0. The fix addresses the incomplete sanitization by ensuring that hasVariant and hasProduct parameters are properly validated before being passed to Craft::configure(). Organizations should upgrade to version 5.6.0 or later as soon as possible.

For detailed information about the fix, refer to the GitHub Pull Request #4232 and the release notes for version 5.6.0. Additional security advisory details are available in the GitHub Security Advisory.

Workarounds

• Restrict control panel access to only essential personnel while awaiting patch deployment
• Implement WAF rules to filter requests containing SQL injection patterns in hasVariant and hasProduct parameters
• Consider temporarily disabling or restricting access to product/variant query functionality if business operations permit
• Enable additional logging and monitoring on product and variant query endpoints to detect exploitation attempts