CVE-2026-32271 is an SQL injection vulnerability in Craft Commerce's TotalRevenue widget affecting versions 4.0.0 to 4.10.2 and 5.0.0 to 5.5.4. The vulnerability arises from unsanitized widget settings interpolated into SQL expressions, combined with PDO's multi-statement query support, enabling injection of a malicious serialized PHP object into the queue table. When the queue consumer processes this injected job, the unserialize() call in yii2-queue triggers a GuzzleHttp FileCookieJar gadget chain, whose destructor writes a PHP webshell to the server webroot. Exploitation requires only authenticated control panel access (no admin privileges) and three HTTP requests, with queue processing triggered via an unauthenticated endpoint, leading to remote code execution as the PHP process user. The issue is resolved in Craft Commerce versions 4.10.3 and 5.5.5.

Successful exploitation results in remote code execution on the server with the privileges of the PHP process user. This allows attackers with low-level authenticated access to deploy a PHP webshell, potentially leading to full system compromise. The vulnerability does not require administrative privileges and can be triggered with minimal requests, increasing its severity.

This vulnerability is fixed in Craft Commerce versions 4.10.3 and 5.5.5. Users should upgrade to these or later versions to remediate the issue. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Until patched, restrict authenticated control panel access to trusted users only and monitor for suspicious queue processing activity. Patch status is confirmed by the version ranges fixed; no cloud service remediation applies.