CVE-2026-32272

Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability exists where the ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the input sanitization blocklist added to ElementIndexesController in a prior security fix (GHSA-2453-mppf-46cj). The blocklist only strips top-level Yii2 Query properties such as where and orderBy, but hasVariant and hasProduct pass through untouched and internally call Craft::configure() on a subquery without sanitization, re-introducing SQL injection. Any authenticated control panel user can exploit this via boolean-based blind SQL injection to extract arbitrary database contents, including security keys that enable forging admin sessions for privilege escalation. This issue has been fixed in version 5.6.0.

• CWE-89

• https://github.com/advisories/GHSA-2453-mppf-46cj
• https://github.com/craftcms/commerce/pull/4232
• https://github.com/craftcms/commerce/releases/tag/5.6.0
• https://github.com/craftcms/commerce/security/advisories/GHSA-r54v-qq87-px5r

Published

Apr 13, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32267Craft CMS is a content management system (CMS). From version…9.8
• CVE-2026-32268The Azure Blob Storage for Craft CMS plugin provides an Azur…8.7
• CVE-2026-32269Parse Server is an open source backend that can be deployed …6.5
• CVE-2026-3227A command injection vulnerability was identified in TP-Link …6.8
• CVE-2026-32270Craft Commerce is an ecommerce platform for Craft CMS. In ve…1.7
• CVE-2026-32271Craft Commerce is an ecommerce platform for Craft CMS. In ve…7.7
• CVE-2026-32273Discourse is an open-source discussion platform. From versio…5.4
• CVE-2026-32274Black is the uncompromising Python code formatter. Starting …7.5
• CVE-2026-32275Tautulli is a Python based monitoring and tracking tool for …9.1
• CVE-2026-32276Connect-CMS is a content management system. In versions on t…8.8
• CVE-2026-32277Connect-CMS is a content management system. In versions 1.35…8.7
• CVE-2026-32278Connect-CMS is a content management system. In versions on t…4.8