Craft Commerce, an ecommerce plugin for Craft CMS, is vulnerable in versions before 4.10.2 and 5.5.3 to SQL injection through the purchasables table endpoint. The sort parameter is parsed by splitting on a pipe, and the first token—intended as the column name—is inserted directly as an array key into orderBy() without any whitelist validation. Because Yii 2’s query builder does not escape array keys, an authenticated user can inject arbitrary SQL into the ORDER BY clause, enabling them to manipulate query results or extract sensitive data.

The affected systems are installations of the Craft Commerce plugin for Craft CMS running any pre‑4.10.2 or pre‑5.5.3 release. All versions that rely on the unpatched purchasables endpoint are exposed, regardless of site size or configuration, as long as the endpoint remains accessible to authenticated users.

This flaw carries a CVSS score of 8.7, indicating high severity, but its EPSS is reported as less than 1 %, and it is not included in the CISA KEV catalog. The bug can be exploited via the normal web interface and requires only valid credentials, so the attack vector is usually remote over HTTP. Although the theoretical impact is significant—potential data leakage or manipulation—the current low exploitation probability and lack of public exploitation data suggest the risk is moderate, yet still warrants timely patching.