Read the docs
TI-2021-12456 Aliases CVE-2021-32790

Blind SQL Injection possible via Authenticated Web-hook Search API Endpoint

Priority LOW 25CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading.

Why it matters now

EPSS 0.01265 69th percentileScored 2026-11-07
Fix Fixed woocommerce (woocommerce): 3.3.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
WooCommercewoocommerce3.3.0 to before 3.3.63.3.6Patch availableCNA
  • woocommerce VendorWooCommerce Affected 3.3.0 to before 3.3.6 Fixed in 3.3.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:woocommerce:woocommerce:*:*:*:*:*:wordpress:*:*3.3.0 to before 3.3.6; 3.4.0 to before 3.4.8; 3.5.0 to before 3.5.9; 3.6.0 to before 3.6.6; 3.7.0 to before 3.7.2; 3.8.0 to before 3.8.2; 3.9.0 to before 3.9.4; 4.0.0 to before 4.0.2; 4.1.0 to before 4.1.2; 4.2.0 to before 4.2.3; 4.3.0 to before 4.3.4; 4.4.0 to before 4.4.2; 4.5.0 to before 4.5.3; 4.6.0 to before 4.6.3; 4.7.0 to before 4.7.2; 4.8.0 to before 4.8.1; 4.9.0 to before 4.9.3; 5.0.0 to before 5.0.1; 5.1.0 to before 5.1.1; 5.2.0 to before 5.2.3; 5.3.0 to before 5.3.1; 5.4.0 to before 5.4.2; 5.5.0 to before 5.5.1VulnerableWooCommerce
  • cpe:2.3:a:woocommerce:woocommerce:*:*:*:*:*:wordpress:*:* Versions 3.3.0 to before 3.3.6; 3.4.0 to before 3.4.8; 3.5.0 to before 3.5.9; 3.6.0 to before 3.6.6; 3.7.0 to before 3.7.2; 3.8.0 to before 3.8.2; 3.9.0 to before 3.9.4; 4.0.0 to before 4.0.2; 4.1.0 to before 4.1.2; 4.2.0 to before 4.2.3; 4.3.0 to before 4.3.4; 4.4.0 to before 4.4.2; 4.5.0 to before 4.5.3; 4.6.0 to before 4.6.3; 4.7.0 to before 4.7.2; 4.8.0 to before 4.8.1; 4.9.0 to before 4.9.3; 5.0.0 to before 5.0.1; 5.1.0 to before 5.1.1; 5.2.0 to before 5.2.3; 5.3.0 to before 5.3.1; 5.4.0 to before 5.4.2; 5.5.0 to before 5.5.1 Vulnerable ·WooCommerce

Remediation

  • Fix · CNA woocommerce (woocommerce) Fixed in 3.3.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32790

References

Patch 1

Advisory 1

  • TI-2022-00684 WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion CVSS 3.1MEDIUM 4.3
  • TI-2017-13530 In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible… CVSS 3.0HIGH 8.8
  • TI-2019-15109 WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site… CVSS 3.1HIGH 8.8
  • TI-2018-14697 The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is… CVSS 3.0HIGH 8.1
  • TI-2023-28650 WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2024-09228 WooCommerce <= 9.0.2 - Unauthenticated HTML Injection CVSS 3.1MEDIUM 6.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences