CVE-2026-32272: Craft Commerce hasVariant/hasProduct Blind SQL Injection
Overview
Craft Commerce’s ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the unset() blocklist added to ElementIndexesController in GHSA-2453-mppf-46cj.
The blocklist only strips top-level Yii2 Query properties (where, orderBy, etc.), but hasVariant and hasProduct pass through untouched. Internally, these properties call Craft::configure() on a subquery without sanitization, re-introducing SQL injection via criteria[hasVariant][where]=INJECTEDSQL.
An authenticated control panel user can perform boolean-based blind SQL injection through the patched ElementIndexesController and extract arbitrary database contents.
Impact
Full database read access via blind SQL injection Privilege escalation via security key extraction → forged admin sessions
Prerequisites Authenticated control panel user Commerce plugin installed Products with variants in the database
Other sources
Craft Commerce hasVariant/hasProduct Blind SQL Injection
— Packagist
Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability exists where the ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the input sanitization blocklist added to ElementIndexesController in a prior security fix (GHSA-2453-mppf-46cj). The blocklist only strips top-level Yii2 Query properties such as where and orderBy, but hasVariant and hasProduct pass through untouched and internally call Craft::configure() on a subquery without sanitization, re-introducing SQL injection. Any authenticated control panel user can exploit this via boolean-based blind SQL injection to extract arbitrary database contents, including security keys that enable forging admin sessions for privilege escalation. This issue has been fixed in version 5.6.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/craftcms/commerceto a version that resolves this vulnerability.Fixed in 5.6.0 - Upgrade
Upgrade
Craft Commerceto a version that resolves this vulnerability.Fixed in 5.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32272?
CVE-2026-32272 is classified as a high-severity vulnerability due to its potential for exploitation via blind SQL injection.
How do I fix CVE-2026-32272?
To fix CVE-2026-32272, upgrade Craft Commerce to version 5.5.5 or later, where the vulnerability has been addressed.
What versions of Craft Commerce are affected by CVE-2026-32272?
CVE-2026-32272 affects Craft Commerce versions from 5.0.0 to 5.5.4.
What are the consequences of exploiting CVE-2026-32272?
Exploiting CVE-2026-32272 could allow an attacker to execute unauthorized SQL queries on the database.
Is CVE-2026-32272 specific to Craft Commerce?
Yes, CVE-2026-32272 is specifically a vulnerability within the Craft Commerce platform.