Packagist/craftcms/commerce CVE-2026-32272: high, EPSS 0.46%

Craft Commerce hasVariant/hasProduct Blind SQL Injection

Action: Upgrade craftcms/commerce to 5.6.0 or later.

composer require craftcms/commerce:5.6.0

Affected

Fixed versions

Sources

• osv: GHSA-r54v-qq87-px5r
• https://github.com/craftcms/commerce/security/advisories/GHSA-r54v-qq87-px5r
• https://nvd.nist.gov/vuln/detail/CVE-2026-32272
• https://github.com/craftcms/commerce/pull/4232
• https://github.com/advisories/GHSA-2453-mppf-46cj
• https://github.com/craftcms/commerce
• https://github.com/craftcms/commerce/releases/tag/5.6.0

CVE-2026-32272 · published 2026-04-14T00:06:56Z · modified 2026-07-08T07:27:37.493014174Z · JSON