Arbitrary SQL (SQL injection) possible via the Store API component.
CVE-2021-32789

7.5HIGH

Key Information:

Vendor: WooCommerce
Status: WooCommerce-gutenberg-products-block
Vendor: CVE Published:; 26 July 2021

🔔 Create WooCommerce Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 91%

What is CVE-2021-32789?

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the wc/store/products/collection-data?calculate_attribute_counts[][taxonomy] endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.

Affected Version(s)

woocommerce-gutenberg-products-block > 2.5.0, < 2.5.16

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-32789
Created by and0x00