CVE-2021-32789

    Dashboard / Vulnerabilities / CVE-2021-32789

    CVE-2021-32789

    Published: 26 Jul 2021Last Modified: 27 Aug 2026

    Summary:

    Details: woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.

    References: https://woocommerce.com/posts/critical-vulnerability-detected-july-2021/, https://hackerone.com/reports/1260787, https://wooengineering.wordpress.com/2021/07/14/incident-report-sql-injection-via-store-api/, https://github.com/woocommerce/woocommerce-gutenberg-products-block-ghsa-6hq4-w6wv-8wrp/pull/1, https://github.com/woocommerce/woocommerce-gutenberg-products-block/security/advisories/GHSA-6hq4-w6wv-8wrp

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 76fdbe3c36ca43ac6117a7dfb50ad8d2e4e71aa1
    Fixed -3bd91b669247000fd3f5277954701d0b148d3f1a

    Affected versions

    v4.9.1
    v4.9.1-dev
    v4.9.0-dev

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32789 | CVE-DB