CVE-2021-32789
Arbitrary SQL (SQL injection) possible via the Store API component.
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.
woocommerce-gutenberg-products-block es un plugin de características para WooCommerce Gutenberg Blocks. Una vulnerabilidad de inyección SQL afecta a todos los sitios de WooCommerce que ejecutan el plugin de características WooCommerce Blocks entre la versión 2.5.0 y anterior a versión 2.5.16. Por medio de una URL cuidadosamente diseñada, se puede ejecutar una explotación contra el endpoint "wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]" que permite la ejecución de una consulta sql de sólo lectura. Se presentan parches para muchas versiones de este paquete, a partir de la versión 2.5.16. No se conocen soluciones aparte de la actualización
*Credits:
Josh (jl-dos)
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-05-12 CVE Reserved
- 2021-07-03 CVE Published
- 2023-02-17 First Exploit
- 2024-08-03 CVE Updated
- 2024-11-11 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/woocommerce/woocommerce-gutenberg-products-block-ghsa-6hq4-w6wv-8wrp/pull/1 | Broken Link |
| URL | Date | SRC |
|---|---|---|
| https://github.com/and0x00/CVE-2021-32789 | 2023-02-17 | |
| https://github.com/DonVorrin/CVE-2021-32789 | 2024-02-08 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/woocommerce/woocommerce-gutenberg-products-block/security/advisories/GHSA-6hq4-w6wv-8wrp | 2021-08-05 |
| URL | Date | SRC |
|---|---|---|
| https://woocommerce.com/posts/critical-vulnerability-detected-july-2021 | 2021-08-05 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 2.5.0 < 2.5.16 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 2.5.0 < 2.5.16" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 2.6.0 < 2.6.2 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 2.6.0 < 2.6.2" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 2.7.0 < 2.7.2 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 2.7.0 < 2.7.2" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 2.8.0 < 2.8.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 2.8.0 < 2.8.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 2.9.0 < 2.9.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 2.9.0 < 2.9.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 3.0.0 < 3.0.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 3.0.0 < 3.0.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 3.1.0 < 3.1.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 3.1.0 < 3.1.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 3.2.0 < 3.2.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 3.2.0 < 3.2.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 3.3.0 < 3.3.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 3.3.0 < 3.3.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 3.4.0 < 3.4.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 3.4.0 < 3.4.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 3.5.0 < 3.5.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 3.5.0 < 3.5.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 3.6.0 < 3.6.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 3.6.0 < 3.6.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 3.7.0 < 3.7.2 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 3.7.0 < 3.7.2" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 3.8.0 < 3.8.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 3.8.0 < 3.8.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 3.9.0 < 3.9.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 3.9.0 < 3.9.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 4.0.0 < 4.0.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 4.0.0 < 4.0.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 4.1.0 < 4.1.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 4.1.0 < 4.1.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 4.2.0 < 4.2.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 4.2.0 < 4.2.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 4.3.0 < 4.3.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 4.3.0 < 4.3.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 4.4.0 < 4.4.3 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 4.4.0 < 4.4.3" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 4.5.0 < 4.5.3 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 4.5.0 < 4.5.3" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 4.6.0 < 4.6.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 4.6.0 < 4.6.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 4.7.0 < 4.7.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 4.7.0 < 4.7.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 4.8.0 < 4.8.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 4.8.0 < 4.8.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 4.9.0 < 4.9.2 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 4.9.0 < 4.9.2" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 5.0.0 < 5.0.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 5.0.0 < 5.0.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 5.1.0 < 5.1.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 5.1.0 < 5.1.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 5.2.0 < 5.2.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 5.2.0 < 5.2.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 5.3.0 < 5.3.2 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 5.3.0 < 5.3.2" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 5.4.0 < 5.4.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 5.4.0 < 5.4.1" | wordpress |
Affected
| ||||||
| Automattic Search vendor "Automattic" | Woocommerce Blocks Search vendor "Automattic" for product "Woocommerce Blocks" | >= 5.5.0 < 5.5.1 Search vendor "Automattic" for product "Woocommerce Blocks" and version " >= 5.5.0 < 5.5.1" | wordpress |
Affected
| ||||||