Arbitrary SQL (SQL injection) possible via the Store API component.
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WooCommerce | woocommerce-gutenberg-products-block | > 2.5.0, < 2.5.16 | — | No fix listed | CNA |
- woocommerce-gutenberg-products-block VendorWooCommerce Affected > 2.5.0, < 2.5.16 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:automattic:woocommerce_blocks:*:*:*:*:*:wordpress:*:* | 2.5.0 to before 2.5.16; 2.6.0 to before 2.6.2; 2.7.0 to before 2.7.2; 2.8.0 to before 2.8.1; 2.9.0 to before 2.9.1; 3.0.0 to before 3.0.1; 3.1.0 to before 3.1.1; 3.2.0 to before 3.2.1; 3.3.0 to before 3.3.1; 3.4.0 to before 3.4.1; 3.5.0 to before 3.5.1; 3.6.0 to before 3.6.1; 3.7.0 to before 3.7.2; 3.8.0 to before 3.8.1; 3.9.0 to before 3.9.1; 4.0.0 to before 4.0.1; 4.1.0 to before 4.1.1; 4.2.0 to before 4.2.1; 4.3.0 to before 4.3.1; 4.4.0 to before 4.4.3; 4.5.0 to before 4.5.3; 4.6.0 to before 4.6.1; 4.7.0 to before 4.7.1; 4.8.0 to before 4.8.1; 4.9.0 to before 4.9.2; 5.0.0 to before 5.0.1; 5.1.0 to before 5.1.1; 5.2.0 to before 5.2.1; 5.3.0 to before 5.3.2; 5.4.0 to before 5.4.1; 5.5.0 to before 5.5.1 | Vulnerable | Automattic |
- cpe:2.3:a:automattic:woocommerce_blocks:*:*:*:*:*:wordpress:*:* Versions 2.5.0 to before 2.5.16; 2.6.0 to before 2.6.2; 2.7.0 to before 2.7.2; 2.8.0 to before 2.8.1; 2.9.0 to before 2.9.1; 3.0.0 to before 3.0.1; 3.1.0 to before 3.1.1; 3.2.0 to before 3.2.1; 3.3.0 to before 3.3.1; 3.4.0 to before 3.4.1; 3.5.0 to before 3.5.1; 3.6.0 to before 3.6.1; 3.7.0 to before 3.7.2; 3.8.0 to before 3.8.1; 3.9.0 to before 3.9.1; 4.0.0 to before 4.0.1; 4.1.0 to before 4.1.1; 4.2.0 to before 4.2.1; 4.3.0 to before 4.3.1; 4.4.0 to before 4.4.3; 4.5.0 to before 4.5.3; 4.6.0 to before 4.6.1; 4.7.0 to before 4.7.1; 4.8.0 to before 4.8.1; 4.9.0 to before 4.9.2; 5.0.0 to before 5.0.1; 5.1.0 to before 5.1.1; 5.2.0 to before 5.2.1; 5.3.0 to before 5.3.2; 5.4.0 to before 5.4.1; 5.5.0 to before 5.5.1 Vulnerable ·Automattic
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32789
References
More WooCommerce vulnerabilities
- TI-2023-03274 WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF CVSS 3.1MEDIUM 6.5
- TI-2023-03273 WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF CVSS 3.1MEDIUM 6.5
- TI-2023-02044 WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update CVSS 3.1MEDIUM 6.5
- TI-2022-00684 WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion CVSS 3.1MEDIUM 4.3
- TI-2021-06504 WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE CVSS 3.1CRITICAL 9.8
- TI-2023-17950 WordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL Injection CVSS 3.1CRITICAL 9.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences