Craft Commerce is vulnerable to an SQL injection flaw within the TotalRevenue widget. Unsanitized widget settings are inserted directly into SQL expressions, allowing a logged‑in control‑panel user to inject a malicious PHP object. Through PDO’s default multi‑statement support this object is added to the queue table. When the Yii2‑queue consumer processes the job it unserializes the injected payload, triggering a GuzzleHttp FileCookieJar gadget that writes a PHP webshell to the site’s webroot. The entire exploit chain requires only three HTTP requests, no administrative privileges, and results in arbitrary command execution as the web‑server’s PHP process.

The vulnerability affects Craft Commerce releases 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4 when the TotalRevenue widget is in use. Versions 4.10.3 and later, and 5.5.5 and later, contain the fix and are not affected.

The CVSS score of 7.7 assigns this flaw a high severity. Since the EPSS score is not available, the likelihood of exploitation cannot be quantified, but the exploit requires only minimal effort: three HTTP requests, an authenticated control‑panel login, and an unauthenticated queue consumer endpoint. The vulnerability is not currently listed in CISA’s KEV catalog. The impact is full arbitrary command execution, which can lead to complete server compromise if the web‑server user owns critical resources.