8.8

CVE-2021-32789: automattic woocommerce_blocks SQL Injection

CVSS: 8.8v3.1HighModified
Published 26-07-2021Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2021-32789 is a high (CVSS 8.8) SQL Injection vulnerability in automattic woocommerce_blocks. EPSS estimates a 17.23% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities.

Overall risk
39/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (wordfence)
EPSS score
17.23%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 26-07-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

17.23%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 17.23% on 20-09-2026

20-09-202620-10-2026
EPSS score
17.23%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Automattic1 product
  • woocommerce_blocks≥ 2.5.0, < 2.5.16 | ≥ 2.6.0, < 2.6.2 | ≥ 2.7.0, < 2.7.2 | ≥ 2.8.0, < 2.8.1 | ≥ 2.9.0, < 2.9.1 | ≥ 3.0.0, < 3.0.1 | ≥ 3.1.0, < 3.1.1 | ≥ 3.2.0, < 3.2.1 | ≥ 3.3.0, < 3.3.1 | ≥ 3.4.0, < 3.4.1 | ≥ 3.5.0, < 3.5.1 | ≥ 3.6.0, < 3.6.1 | ≥ 3.7.0, < 3.7.2 | ≥ 3.8.0, < 3.8.1 | ≥ 3.9.0, < 3.9.1 | ≥ 4.0.0, < 4.0.1 | ≥ 4.1.0, < 4.1.1 | ≥ 4.2.0, < 4.2.1 | ≥ 4.3.0, < 4.3.1 | ≥ 4.4.0, < 4.4.3 | ≥ 4.5.0, < 4.5.3 | ≥ 4.6.0, < 4.6.1 | ≥ 4.7.0, < 4.7.1 | ≥ 4.8.0, < 4.8.1 | ≥ 4.9.0, < 4.9.2 | ≥ 5.0.0, < 5.0.1 | ≥ 5.1.0, < 5.1.1 | ≥ 5.2.0, < 5.2.1 | ≥ 5.3.0, < 5.3.2 | ≥ 5.4.0, < 5.4.1 | ≥ 5.5.0, < 5.5.1
Woocommerce1 product
Wordpress1 product
  • woo-gutenberg-products-block≤ 2.5.15 (fixed in 2.5.16) | ≥ 2.6, ≤ 2.6.1 (fixed in 2.5.16) | ≥ 2.7, ≤ 2.7.1 (fixed in 2.5.16) | 2.8 (fixed in 2.5.16) | 2.9 (fixed in 2.5.16) | 3.0 (fixed in 2.5.16) | 3.1 (fixed in 2.5.16) | 3.2 (fixed in 2.5.16) | 3.3 (fixed in 2.5.16) | 3.4 (fixed in 2.5.16) | 3.5 (fixed in 2.5.16) | 3.6 (fixed in 2.5.16) | ≥ 3.7, ≤ 3.7.1 (fixed in 2.5.16) | 3.8 (fixed in 2.5.16) | 3.9 (fixed in 2.5.16) | 4.0 (fixed in 2.5.16) | 4.1 (fixed in 2.5.16) | 4.2 (fixed in 2.5.16) | 4.3 (fixed in 2.5.16) | ≥ 4.4, ≤ 4.4.2 (fixed in 2.5.16) | ≥ 4.5, ≤ 4.5.2 (fixed in 2.5.16) | 4.6 (fixed in 2.5.16) | 4.7 (fixed in 2.5.16) | 4.8 (fixed in 2.5.16) | ≥ 4.9, ≤ 4.9.1 (fixed in 2.5.16) | 5.0 (fixed in 2.5.16) | 5.1 (fixed in 2.5.16) | 5.2 (fixed in 2.5.16) | ≥ 5.3, ≤ 5.3.1 (fixed in 2.5.16) | 5.4 (fixed in 2.5.16) | 5.5 (fixed in 2.5.16)

3 vendors · 3 products

References

6 links