CVE-2026-32270

CVE-2026-32270 is an information disclosure vulnerability affecting Craft Commerce, an ecommerce platform for Craft CMS. The flaw exists in versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, where the PaymentsController::actionPay function exposes sensitive order data to unauthenticated users. When an order number is provided and the email validation fails during anonymous payments, the JSON error response returns the serialized order object containing customer email, shipping address, and billing address information. The vulnerability has a network-based attack vector with low complexity, as it requires only basic knowledge of order numbers to exploit. The impact is limited to confidentiality, exposing personally identifiable information and shipping details without requiring authentication or user interaction. The FAUCET Risk Score of 23.0 out of 100 indicates moderate concern, though the EPSS score of 0.000620000 suggests relatively low exploitation prevalence across the threat landscape. There is no evidence of active exploitation in the wild, no public exploit code appears to be widely available, and community attention remains minimal as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities catalog and its inactive status on hotlist tracking. The issue has been remediated in Craft Commerce versions 4.11.0 and 5.6.0, and affected organizations should prioritize updating to these versions to eliminate the information disclosure risk.