The vulnerability is a blind SQL injection in Craft Commerce versions 5.0.0 through 5.5.4. The ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the blocklist applied to ElementIndexesController, causing an unsanitized subquery to be executed. Any authenticated control‑panel user can send crafted boolean queries that return true or false, allowing extraction of arbitrary database content, including secret security keys that can be used to forge administrative sessions and gain elevated privileges.

Affected systems include all installations of Craft Commerce by craftcms, specifically vendors "craftcms:commerce" running versions 5.0.0 to 5.5.4. The issue was remediated in the 5.6.0 release, which removes the unsanitized path and applies proper query sanitization. Users should verify that their environment is upgraded to at least version 5.6.0 to eliminate the vulnerability.

The CVSS base score of 8.7 indicates high severity, and the absence of an EPSS score suggests that public data about exploit usage is not yet available. The vulnerability is not listed in the CISA KEV catalog, implying no known public exploitation yet, but its exploitation requires only an authenticated control‑panel user. Because it permits extraction of sensitive database values and possible session forging, the risk is significant. Administrators should assume the likelihood of exploitation is real, especially if the environment contains a tainted or compromised CP access.