CVE-2021-32790

published 2021-07-26

CVE-2021-32790: Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin…

Priority P2 77 medium 4.9 CVSS 3.1

AV N AC L PR H UI N S U C H I N A N

ITW VulnCheck KEV

Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
woocommerce	woocommerce	—	—
woocommerce	woocommerce	>= 3.3.0 < 3.3.6	3.3.6
woocommerce	woocommerce	>= 3.4.0 < 3.4.8	3.4.8
woocommerce	woocommerce	>= 3.5.0 < 3.5.9	3.5.9
woocommerce	woocommerce	>= 3.6.0 < 3.6.6	3.6.6
woocommerce	woocommerce	>= 3.7.0 < 3.7.2	3.7.2
woocommerce	woocommerce	>= 3.8.0 < 3.8.2	3.8.2
woocommerce	woocommerce	>= 3.9.0 < 3.9.4	3.9.4
woocommerce	woocommerce	>= 4.0.0 < 4.0.2	4.0.2
woocommerce	woocommerce	>= 4.1.0 < 4.1.2	4.1.2
woocommerce	woocommerce	>= 4.2.0 < 4.2.3	4.2.3
woocommerce	woocommerce	>= 4.3.0 < 4.3.4	4.3.4
woocommerce	woocommerce	>= 4.4.0 < 4.4.2	4.4.2
woocommerce	woocommerce	>= 4.5.0 < 4.5.3	4.5.3
woocommerce	woocommerce	>= 4.6.0 < 4.6.3	4.6.3
woocommerce	woocommerce	>= 4.7.0 < 4.7.2	4.7.2
woocommerce	woocommerce	>= 4.8.0 < 4.8.1	4.8.1
woocommerce	woocommerce	>= 4.9.0 < 4.9.3	4.9.3
woocommerce	woocommerce	>= 5.0.0 < 5.0.1	5.0.1
woocommerce	woocommerce	>= 5.1.0 < 5.1.1	5.1.1
woocommerce	woocommerce	>= 5.2.0 < 5.2.3	5.2.3
woocommerce	woocommerce	>= 5.3.0 < 5.3.1	5.3.1
woocommerce	woocommerce	>= 5.4.0 < 5.4.2	5.4.2
woocommerce	woocommerce	>= 5.5.0 < 5.5.1	5.5.1

CVSS provenance

nvd v3.1 4.9 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

vulncheck 4.9 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89