# CVE-2026-32270: Craft CMS Craft Commerce information disclosure in PaymentsController

Source: https://junglewise.ai/threats/cve-2026-32270-craft-cms-craft-commerce-information-disclosure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-32270 · Severity: medium · CVSS 4 · Published 2026-04-13

Craft Commerce, an e-commerce platform for Craft CMS, contains a vulnerability that can leak customer information. If an attacker knows or guesses an order number, they can trigger an error during the payment process that reveals sensitive details like the customer's email address and physical shipping or billing addresses. This could lead to unauthorized access to private customer data and potential privacy concerns.

Technologies: [craftcms/commerce (Packagist)](https://junglewise.ai/threats/technologies/craftcms-commerce). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-32270 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32270 being exploited in the wild.

**How severe is CVE-2026-32270?** Medium severity, with a CVSS score of 4, published 13 April 2026.

**Which products and versions are affected?** craftcms/commerce (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.6.0.

**Is there a fix for CVE-2026-32270?** Yes. craftcms/commerce (Packagist): upgrade to 5.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32270 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-32270?** Check whether you run craftcms/commerce (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- craftcms/commerce (Packagist): upgrade to 5.6.0 or later

  ```sh
  composer require craftcms/commerce:^5.6.0
  ```


## Technical details

An information disclosure vulnerability exists in the `PaymentsController::actionPay` component of Craft Commerce. The application retrieves order details by order number before fully validating the requester's authorization (specifically the matching email check for anonymous payments). When the authorization check fails, the resulting JSON error response incorrectly includes a serialized order object. This object contains sensitive fields including customer email, shipping address, and billing address. An unauthenticated attacker with knowledge of a valid order number can exploit this to retrieve private order data. The issue is fixed in versions 4.11.0 and 5.6.0.

## Affected products

- Craft CMS Commerce >= 4.0.0, <= 4.10.2
- Craft CMS Commerce >= 5.0.0, <= 5.5.4

## Identifiers

- CVE-2026-32270
- GHSA-3vxg-x5f8-f5qf

## Timeline

- 2026-04-13: patched: Versions 4.11.0 and 5.6.0 released
- 2026-04-14: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/tianluov](https://api.github.com/users/tianluov)
- [https://github.com/tianluov](https://github.com/tianluov)
- [https://api.github.com/users/tianluov/gists%7B/gist_id%7D](https://api.github.com/users/tianluov/gists%7B/gist_id%7D)
- [https://api.github.com/users/tianluov/repos](https://api.github.com/users/tianluov/repos)
- [https://avatars.githubusercontent.com/u/194936196?v=4](https://avatars.githubusercontent.com/u/194936196?v=4)
- [https://api.github.com/users/tianluov/events%7B/privacy%7D](https://api.github.com/users/tianluov/events%7B/privacy%7D)

## Related threats

- [Craft CMS Craft Commerce coupon brute-force via rate limit bypass](https://junglewise.ai/threats/cve-2026-55795-craft-cms-craft-commerce-coupon-brute-force-via-rate-limit-bypass)
- [Craft CMS Commerce SQL injection in Product and Variant queries](https://junglewise.ai/threats/cve-2026-32272-craft-cms-commerce-sql-injection-in-product-and-variant-queries)
- [Craft CMS Commerce SQL injection and RCE in TotalRevenue widget](https://junglewise.ai/threats/cve-2026-32271-craft-cms-commerce-sql-injection-and-rce-in-totalrevenue-widget)
- [Craft Commerce: Potential IDOR in Commerce carts](https://junglewise.ai/threats/cve-2026-31867-craft-commerce-potential-idor-in-commerce-carts)
- [Craft Commerce has stored XSS in Craft Commerce Order Details Slideout](https://junglewise.ai/threats/cve-2026-29177-craft-commerce-has-stored-xss-in-craft-commerce-order-details)