8.8

CVE-2021-32790: woocommerce SQL Injection

CVSS: 8.8v3.1HighModified
Published 26-07-2021Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2021-32790 is a high (CVSS 8.8) SQL Injection vulnerability in woocommerce. EPSS estimates a 1.26% chance of exploitation in the next 30 days, higher than 69.3% of scored vulnerabilities. Fixed in 3.3.6.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (wordfence)
EPSS score
1.26%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 26-07-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

1.26%

Chance of exploitation in the next 30 days

Percentile

69%

Versus all other CVEs

30-day change

0.00 pp

From 1.26% on 20-09-2026

20-09-202620-10-2026
EPSS score
1.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Woocommerce1 product
  • woocommerce≥ 3.3.0, < 3.3.6 | ≥ 3.4.0, < 3.4.8 | ≥ 3.5.0, < 3.5.9 | ≥ 3.6.0, < 3.6.6 | ≥ 3.7.0, < 3.7.2 | ≥ 3.8.0, < 3.8.2 | ≥ 3.9.0, < 3.9.4 | ≥ 4.0.0, < 4.0.2 | ≥ 4.1.0, < 4.1.2 | ≥ 4.2.0, < 4.2.3 | ≥ 4.3.0, < 4.3.4 | ≥ 4.4.0, < 4.4.2 | ≥ 4.5.0, < 4.5.3 | ≥ 4.6.0, < 4.6.3 | ≥ 4.7.0, < 4.7.2 | ≥ 4.8.0, < 4.8.1 | ≥ 4.9.0, < 4.9.3 | ≥ 5.0.0, < 5.0.1 | ≥ 5.1.0, < 5.1.1 | ≥ 5.2.0, < 5.2.3 | ≥ 5.3.0, < 5.3.1 | ≥ 5.4.0, < 5.4.2 | ≥ 5.5.0, < 5.5.1
Wordpress1 product
  • woocommerce< 3.3 (fixed in 3.3.6) | ≥ 3.3, ≤ 3.3.5 (fixed in 3.3.6) | ≥ 3.4, ≤ 3.4.7 (fixed in 3.3.6) | ≥ 3.5, ≤ 3.5.8 (fixed in 3.3.6) | ≥ 3.6, ≤ 3.6.5 (fixed in 3.3.6) | ≥ 3.7, ≤ 3.7.1 (fixed in 3.3.6) | ≥ 3.8, ≤ 3.8.1 (fixed in 3.3.6) | ≥ 3.9, ≤ 3.9.3 (fixed in 3.3.6) | ≥ 4.0, ≤ 4.0.1 (fixed in 3.3.6) | ≥ 4.1, ≤ 4.1.1 (fixed in 3.3.6) | ≥ 4.2, ≤ 4.2.2 (fixed in 3.3.6) | ≥ 4.3, ≤ 4.3.3 (fixed in 3.3.6) | ≥ 4.4, ≤ 4.4.1 (fixed in 3.3.6) | ≥ 4.5, ≤ 4.5.2 (fixed in 3.3.6) | ≥ 4.6, ≤ 4.6.2 (fixed in 3.3.6) | ≥ 4.7, ≤ 4.7.1 (fixed in 3.3.6) | 4.8 (fixed in 3.3.6) | ≥ 4.9, ≤ 4.9.2 (fixed in 3.3.6) | 5.0 (fixed in 3.3.6) | 5.1 (fixed in 3.3.6) | ≥ 5.2, ≤ 5.2.2 (fixed in 3.3.6) | 5.3 (fixed in 3.3.6) | ≥ 5.4, ≤ 5.4.1 (fixed in 3.3.6) | 5.5 (fixed in 3.3.6)

2 vendors · 2 products

References

3 links