Summary
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
A SQL injection in the Commerce TotalRevenue widget can lead to remote code execution through a chain of four vulnerabilities:
SQL Injection -- The TotalRevenue stat interpolates unsanitized widget settings directly into a sprintf-based SQL Expression. Any control panel user can create any widget type without permission checks.
PDO Multi-Statement Queries -- PHP
PDO MySQLenablesCLIENT_MULTI_STATEMENTSby default. Neither Yii2 nor Craft CMS disables it. This allows stacking an INSERT statement after the injected SELECT , writing a maliciously serialized PHP object into the queue table.Unrestricted
unserialize()-- The yii2-queue PhpSerializer callsunserialize()with no allowed_classes restriction on every queue job. When the queue consumer processes the injected job, it instantiates the attacker-controlled object.Gadget Chain (FileCookieJar) --
GuzzleHttp\Cookie\FileCookieJar(a standard Guzzle dependency) has an unguarded__destruct()method that callsfile_put_contents(). The attacker’s serialized payload writes a PHP webshell to the server’s webroot. PHP tags survivejson_encode()because Guzzle usesoptions=0(noJSON_HEX_TAG).
The complete chain requires 3 HTTP requests and achieves arbitrary command execution as the PHP process user. Queue processing is triggered via GET /actions/queue/run, an endpoint that requires no authentication ($allowAnonymous = ['run']).
RCE Exploitation Steps
- Authenticate as any control panel user
- POST to
/admin/actions/dashboard/create-widgetwith stacked SQL injection: settings[type]contains the stacked INSERT with the serialized gadget chain- Response: HTTP 500 (expected -- INSERT already committed)
- Trigger queue processing:
GET /actions/queue/run - Queue consumer deserializes the gadget chain
FileCookieJar::__destruct()writes webshell to webroot- Access the webshell:
GET /poc_rce.php?c=id - Response:
uid=1000(home) gid=1000(home) groups=1000(home)
Impact
Untrusted input alters a database query, allowing the attacker to read or modify data the query was not intended to access. Typical impact: data disclosure or modification.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
craftcms/commerce to 4.10.3 or later; craftcms/commerce to 5.5.5 or later
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-32271? CVE-2026-32271 is a high-severity SQL injection vulnerability in craftcms/commerce (composer), affecting versions >= 4.0.0, <= 4.10.2. It is fixed in 4.10.3, 5.5.5. Untrusted input alters a database query, allowing the attacker to read or modify data the query was not intended to access.
- Which versions of craftcms/commerce are affected by CVE-2026-32271? craftcms/commerce (composer) versions >= 4.0.0, <= 4.10.2 is affected.
- Is there a fix for CVE-2026-32271? Yes. CVE-2026-32271 is fixed in 4.10.3, 5.5.5. Upgrade to this version or later.
- Is CVE-2026-32271 exploitable, and should I be worried? Whether CVE-2026-32271 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-32271 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-32271?
- Upgrade
craftcms/commerceto 4.10.3 or later - Upgrade
craftcms/commerceto 5.5.5 or later
- Upgrade