Is CVE-2026-32271 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32271 being exploited in the wild.

How severe is CVE-2026-32271?

High severity, with a CVSS score of 4, published 13 April 2026.

Which products and versions are affected?

craftcms/commerce (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.10.3.

Is there a fix for CVE-2026-32271?

Yes. craftcms/commerce (Packagist): upgrade to 4.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32271 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-32271?

Check whether you run craftcms/commerce (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32271: Craft CMS Commerce SQL injection and RCE in TotalRevenue widget

CVE-2026-32271 · Severity: high · CVSS 4 · Published 2026-04-13

Craft Commerce, an e-commerce platform for Craft CMS, contains a security vulnerability in its dashboard reporting tools. An authorized user with access to the control panel can exploit this flaw to execute malicious commands on the underlying server. This could lead to a complete takeover of the website, theft of customer data, or disruption of business operations.

Technologies: craftcms/commerce (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-32271 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32271 being exploited in the wild.
How severe is CVE-2026-32271?: High severity, with a CVSS score of 4, published 13 April 2026.
Which products and versions are affected?: craftcms/commerce (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.10.3.
Is there a fix for CVE-2026-32271?: Yes. craftcms/commerce (Packagist): upgrade to 4.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32271 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-32271?: Check whether you run craftcms/commerce (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

craftcms/commerce (Packagist): upgrade to 4.10.3 or later
```
composer require craftcms/commerce:^4.10.3
```

Technical details

A SQL injection vulnerability exists in the TotalRevenue widget of Craft Commerce due to unsanitized widget settings being interpolated into a sprintf-based SQL expression. Because PHP PDO MySQL enables multi-statements by default, an attacker can stack an INSERT statement to inject a maliciously serialized PHP object into the queue table. When the unauthenticated '/actions/queue/run' endpoint is triggered, the yii2-queue PhpSerializer performs an unrestricted unserialize() call. This allows an attacker to use a GuzzleHttp\Cookie\FileCookieJar gadget chain to write a PHP webshell to the webroot, achieving remote code execution as the PHP process user. The vulnerability is patched in versions 4.10.3 and 5.5.5.

Affected products

Craft CMS Commerce >= 4.0.0, <= 4.10.2, >= 5.0.0, <= 5.5.4

Identifiers

CVE-2026-32271
GHSA-875v-7m49-8x88

Timeline

2026-04-13: advisory: NVD publication date
2026-04-14: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.