7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32271

CVE-2026-32271: Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget

Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, there is an SQL injection vulnerability in the Commerce TotalRevenue widget which allows any authenticated control panel user to achieve remote code execution through a four-step exploitation chain. The attack exploits unsanitized widget settings interpolated into SQL expressions, combined with PDO's default multi-statement query support, to inject a maliciously serialized PHP object into the queue table. When the queue consumer processes the injected job, the unrestricted unserialize() call in yii2-queue instantiates a GuzzleHttp FileCookieJar gadget chain whose __destruct() method writes a PHP webshell to the server's webroot. The complete chain requires only three HTTP requests, no administrative privileges, and results in arbitrary command execution as the PHP process user, with queue processing triggered via an unauthenticated endpoint. This issue has been fixed in versions 4.10.3 and 5.5.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32271

CVE-2026-32271:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/commerce	composer	>= 4.0.0, <= 4.10.2	4.10.3
craftcms/commerce	composer	>= 5.0.0, <= 5.5.4	5.5.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a SQL injection in the TotalRevenue widget of Craft Commerce, which can be escalated to remote code execution. The root cause is the lack of input sanitization on the type parameter of the TotalRevenue widget. This parameter is used to construct a SQL query in the getData method of the craftcms\commerce\stats\TotalRevenue class.

The patch addresses this vulnerability in two places:

In src/widgets/TotalRevenue.php, a new defineRules method is added to the TotalRevenue widget to validate the type parameter, ensuring it is one of the allowed values. This is a preventative measure at the input boundary.
In src/stats/TotalRevenue.php, the getData method is modified to include a check that validates the type property before it is used in the SQL query. This is a direct fix for the SQL injection vulnerability.

Therefore, the craftcms\commerce\stats\TotalRevenue::getData function is the primary vulnerable function where the SQL injection occurs. The craftcms\commerce\widgets\TotalRevenue widget is the entry point for the malicious input, and the lack of validation in this widget (prior to the patch) is a key part of the vulnerability chain.

Vulnerable functions

craftcms\commerce\stats\TotalRevenue::getData

src/stats/TotalRevenue.php

The `getData` function in the `TotalRevenue` stat class was vulnerable to SQL injection. The `type` property, which is user-controllable via widget settings, was directly interpolated into a SQL expression using `sprintf` without any prior sanitization. This allowed an attacker to inject arbitrary SQL commands.

craftcms\commerce\widgets\TotalRevenue::defineRules

src/widgets/TotalRevenue.php

The `TotalRevenue` widget was missing input validation for its settings. The patch introduces the `defineRules` method to add a validation rule that restricts the `type` parameter to a set of allowed values. The absence of this validation allowed malicious input to be passed to the `TotalRevenue` stat, leading to the SQL injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.