CVE-2026-32272
1 advisory.
Packagist/craftcms/commerce CVE-2026-32272: high, EPSS 0.46%
Craft Commerce hasVariant/hasProduct Blind SQL Injection
Action: Upgrade craftcms/commerce to 5.6.0 or later.
composer require craftcms/commerce:5.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 5.6.0 | - |
Fixed versions
| 5.6.0 |
Sources
- osv: GHSA-r54v-qq87-px5r
- https://github.com/craftcms/commerce/security/advisories/GHSA-r54v-qq87-px5r
- https://nvd.nist.gov/vuln/detail/CVE-2026-32272
- https://github.com/craftcms/commerce/pull/4232
- https://github.com/advisories/GHSA-2453-mppf-46cj
- https://github.com/craftcms/commerce
- https://github.com/craftcms/commerce/releases/tag/5.6.0
CVE-2026-32272 · published · modified · JSON