CVE-2021-32790

    Dashboard / Vulnerabilities / CVE-2021-32790

    CVE-2021-32790

    Published: 26 Jul 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading.

    References: https://woocommerce.com/posts/critical-vulnerability-detected-july-2021/, https://github.com/woocommerce/woocommerce/security/advisories/GHSA-7vx5-x39w-q24g

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8539649e4e1a99c42b64fd203ee382b65124fb94
    Fixed -10aedc7c9be0aa7504ff3ef9401eac7eb51e6e95

    Affected versions

    3.3.5
    3.3.4
    3.3.3
    3.3.2
    3.3.2-rc.1
    3.3.1
    3.3.1-rc.1
    3.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32790 | CVE-DB