CVE-2026-32271 | Craft CMS up to 4.10.2/5.5.4 Commerce TotalRevenue Widget unserialize sql injection

A vulnerability was found in Craft CMS up to 4.10.2/5.5.4 and classified as critical. Affected by this vulnerability is the function unserialize of the component Commerce TotalRevenue Widget. Executing a manipulation can lead to sql injection.

The identification of this vulnerability is CVE-2026-32271. The attack may be launched remotely. There is no exploit available.

It is suggested to upgrade the affected component.