Which versions of PHP are affected by CVE-2026-32271?

Craft Commerce versions 4.0.0-4.10.2 and 5.0.0-5.5.4 contain a critical remote code execution vulnerability affecting authenticated control panel users who can modify widget settings.. A patch is available.

How to fix or mitigate CVE-2026-32271?

Within 24 hours: Identify all Craft Commerce 4.x and 5.x instances in your environment and document current versions. Within 7 days: Apply vendor-released patch to all affected instances (upgrade to Craft Commerce 4.10.3+ or 5.5.5+); test patches in staging first. Within 30 days: Conduct access reviews to restrict control panel privileges to essential personnel only and enable audit logging for widget configuration changes.

PHP CVE-2026-32271

Q: What is the CVSS score of CVE-2026-32271?

CVE-2026-32271 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-22075 HIGH

SQL Injection (CWE-89)

2026-04-13 GitHub_M

GHSA-875v-7m49-8x88

SQLi Deserialization RCE PHP

7.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:35 vuln.today

Patch released

Apr 14, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 13, 2026 - 21:00 euvd

EUVD-2026-22075

Analysis Generated

Apr 13, 2026 - 21:00 vuln.today

CVE Published

Apr 13, 2026 - 20:19 nvd

HIGH 7.7

DescriptionGitHub Advisory

Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, there is an SQL injection vulnerability in the Commerce TotalRevenue widget which allows any authenticated control panel user to achieve remote code execution through a four-step exploitation chain. The attack exploits unsanitized widget settings interpolated into SQL expressions, combined with PDO's default multi-statement query support, to inject a maliciously serialized PHP object into the queue table. When the queue consumer processes the injected job, the unrestricted unserialize() call in yii2-queue instantiates a GuzzleHttp FileCookieJar gadget chain whose __destruct() method writes a PHP webshell to the server's webroot. The complete chain requires only three HTTP requests, no administrative privileges, and results in arbitrary command execution as the PHP process user, with queue processing triggered via an unauthenticated endpoint. This issue has been fixed in versions 4.10.3 and 5.5.5.

AnalysisAI

Remote code execution via SQL injection in Craft Commerce 4.x (4.0.0-4.10.2) and 5.x (5.0.0-5.5.4) allows authenticated control panel users to write PHP webshells through a four-step exploitation chain. Attack exploits unsanitized TotalRevenue widget settings interpolated into SQL, PDO multi-statement support, and unsafe PHP deserialization in yii2-queue to instantiate a GuzzleHttp FileCookieJar gadget chain. Complete exploitation requires only three HTTP requests and low-privileged authenticati

Technical ContextAI

Craft Commerce is a first-party ecommerce extension for Craft CMS, built on the Yii2 PHP framework. The vulnerability chains together three distinct weaknesses: CWE-89 SQL injection in widget configuration handling, PHP object injection via PDO's multi-query execution, and unsafe deserialization in the yii2-queue library. The TotalRevenue widget accepts user-controlled settings that are directly interpolated into SQL expressions without proper sanitization. By exploiting PDO's default allowance of multiple SQL statements per query, an attacker injects a serialized PHP object into the queue table. When Craft's background job processor consumes this queue entry, yii2-queue's unserialize() call instantiates the payload. The attacker leverages a property-oriented programming gadget chain in GuzzleHttp's FileCookieJar class whose __destruct() magic method writes arbitrary file content during object destruction, enabling webshell deployment to the webroot.

RemediationAI

Upgrade immediately to Craft Commerce 4.10.3 or 5.5.5 depending on major version branch. Vendor-released patch available via Composer package manager or direct download from craftcms.com. Patch commit 6d2d24b3a2b0c06593856d05446f82bd8af92d72 addresses the issue by sanitizing widget settings and implementing parameterized queries for SQL execution. No workarounds exist that fully mitigate the vulnerability; temporary risk reduction possible by restricting control panel access to only fully trusted administrators and auditing existing dashboard widgets for suspicious configurations. Review webserver directories for unauthorized PHP files created between initial Commerce installation and patch deployment. Consult official security advisory at https://github.com/craftcms/commerce/security/advisories/GHSA-875v-7m49-8x88 for additional context.