CVE-2021-32789CWE-89

Arbitrary SQL (SQL injection) possible via the Store API component.

High · published July 26, 2021

CVSS v3.1
7.5
EPSS
17%
Percentile
97.1
In the wild
Unconfirmed
What it is

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.17227 · 97.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2021-07-26T15:30Z
EPSS history
Timeline
  • 26 JUL 15:30Z
    Arbitrary SQL (SQL injection) possible via the Store API component.
    cvelistv5