Login Request a demo
Medium severity · published Jul 26, 2021
CVE-2021-32790
Woocommerce is an open source eCommerce plugin for WordPress
4.9
CVSS
1.3%
EPSS
No
On KEV
Description
Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
Woocommerce · Woocommerce
3.3.0 before 3.3.6; 3.4.0 before 3.4.8; 3.5.0 before 3.5.9; 3.6.0 before 3.6.6; 3.7.0 before 3.7.2; 3.8.0 before 3.8.2; +17 more · source: NVD
Affected product
WO
Woocommerce
Woocommerce
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32790
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32790
Patch
https://github.com/woocommerce/woocommerce/security/advisories/GHSA-7vx5-x39w-q24g
Vendor Advisory
https://woocommerce.com/posts/critical-vulnerability-detected-july-2021/
More from Woocommerce
9.8
CVE-2022-50972
WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php
8.8
CVE-2023-52222
WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)
8.8
CVE-2019-20891
WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via…
8.8
CVE-2017-18356
In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager…
8.1
CVE-2018-20714
The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability