Commerce EUVD-2026-22077

Requires authenticated access to the Craft Commerce control panel with permissions to execute ProductQuery or VariantQuery operations through the ElementIndexesController. Specifically affects installations running Craft Commerce versions 5.0.0 through 5.5.4 where authenticated users can interact with product or variant listing interfaces that process hasVariant or hasProduct query parameters.

Real-world risk assessment requires balancing multiple signals. The CVSS 4.0 score of 8.7 reflects high severity due to network attack vector (AV:N), low complexity (AC:L), and high confidentiality/integrity/availability impact (VC:H/VI:H/VA:H). However, exploitation requires authenticated control panel access (PR:L), significantly reducing the attack surface compared to unauthenticated vulnerabilities. The EPSS score of 0.03% (8th percentile) indicates very low probability of exploitation in the wild based on current threat intelligence. No CISA KEV listing and no public exploit identified at time of analysis further suggest this is not being actively targeted. The SSVC framework assessment: exploitation status is 'none public', automatable is 'no' (requires authenticated session and iterative blind SQLi), technical impact is 'total' (privilege escalation to admin). This positions the vulnerability as a real architectural flaw requiring remediation, but not an imminent mass-exploitation threat. Priority should be medium-high for organizations running Craft Commerce with multiple control panel users, especially where insider threat or account compromise is a concern. The privilege escalation path from authenticated user to admin via security key theft makes this more dangerous than a simple data leak SQLi.

An authenticated attacker with control panel access crafts malicious ProductQuery or VariantQuery requests containing SQL injection payloads in the hasVariant or hasProduct parameters. Using boolean-based blind SQL injection techniques, the attacker iteratively extracts database contents including Craft CMS security keys. With these keys, the attacker forges an administrative session token, logs in as an admin, and gains full control over the Craft Commerce installation including customer data, orders, and site configuration.