Is CVE-2026-32270 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32270 being exploited in the wild.

How severe is CVE-2026-32270?

Medium severity, with a CVSS score of 4, published 13 April 2026.

Which products and versions are affected?

craftcms/commerce (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.6.0.

Is there a fix for CVE-2026-32270?

Yes. craftcms/commerce (Packagist): upgrade to 5.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32270 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-32270?

Check whether you run craftcms/commerce (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32270: Craft CMS Craft Commerce information disclosure in PaymentsController

CVE-2026-32270 · Severity: medium · CVSS 4 · Published 2026-04-13

Craft Commerce, an e-commerce platform for Craft CMS, contains a vulnerability that can leak customer information. If an attacker knows or guesses an order number, they can trigger an error during the payment process that reveals sensitive details like the customer's email address and physical shipping or billing addresses. This could lead to unauthorized access to private customer data and potential privacy concerns.

Technologies: craftcms/commerce (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-32270 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32270 being exploited in the wild.
How severe is CVE-2026-32270?: Medium severity, with a CVSS score of 4, published 13 April 2026.
Which products and versions are affected?: craftcms/commerce (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.6.0.
Is there a fix for CVE-2026-32270?: Yes. craftcms/commerce (Packagist): upgrade to 5.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32270 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-32270?: Check whether you run craftcms/commerce (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

craftcms/commerce (Packagist): upgrade to 5.6.0 or later
```
composer require craftcms/commerce:^5.6.0
```

Technical details

An information disclosure vulnerability exists in the `PaymentsController::actionPay` component of Craft Commerce. The application retrieves order details by order number before fully validating the requester's authorization (specifically the matching email check for anonymous payments). When the authorization check fails, the resulting JSON error response incorrectly includes a serialized order object. This object contains sensitive fields including customer email, shipping address, and billing address. An unauthenticated attacker with knowledge of a valid order number can exploit this to retrieve private order data. The issue is fixed in versions 4.11.0 and 5.6.0.

Affected products

Craft CMS Commerce >= 4.0.0, <= 4.10.2
Craft CMS Commerce >= 5.0.0, <= 5.5.4

Identifiers

CVE-2026-32270
GHSA-3vxg-x5f8-f5qf

Timeline

2026-04-13: patched: Versions 4.11.0 and 5.6.0 released
2026-04-14: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.