{"action":"Upgrade craftcms/commerce to 4.10.3 or later.","affected":[{"fixed":"4.10.3","introduced":"4.0.0"},{"fixed":"5.5.5","introduced":"5.0.0"}],"component":"craftcms/commerce","cve_ids":["CVE-2026-32271"],"ecosystem":"Packagist","epss":0.00595,"exploited":false,"fixed_versions":["4.10.3","5.5.5"],"ghsa_id":"GHSA-875v-7m49-8x88","id":"tcs_01M5KEYRYC2EH9W937ZMZX3EEY","modified_at":"2026-04-14T00:41:06.972131Z","published_at":"2026-04-14T00:07:34Z","references":["https://osv.dev/vulnerability/GHSA-875v-7m49-8x88","https://github.com/craftcms/commerce/security/advisories/GHSA-875v-7m49-8x88","https://nvd.nist.gov/vuln/detail/CVE-2026-32271","https://github.com/craftcms/commerce/commit/6d2d24b3a2b0c06593856d05446f82bd8af92d72","https://github.com/craftcms/commerce"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-875v-7m49-8x88","url":"https://osv.dev/vulnerability/GHSA-875v-7m49-8x88"}],"summary":"Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget"}