CVE-2021-32789 is a high-severity SQL injection vulnerability affecting WooCommerce sites running the WooCommerce Blocks feature plugin versions 2.5.0 through 2.5.15. An unauthenticated attacker can exploit this via a crafted URL to the wc/store/products/collection-data?calculate_attribute_counts[][taxonomy] endpoint, allowing execution of read-only SQL queries. With a CVSS score of 7.5 and an EPSS score of 0.92427, this vulnerability has a high probability of exploitation, though it is not currently listed in CISA's KEV catalog. While there are no known active exploits or Metasploit modules, Nuclei templates exist, indicating public exploit code availability, yet there is minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.5.0, < 2.5.16CPE matchmatch criteria | cpe:2.3:a:automattic:woocommerce_blocks:*:*:*:*:*:wordpress:*:* | ||
>= 2.6.0, < 2.6.2CPE matchmatch criteria | cpe:2.3:a:automattic:woocommerce_blocks:*:*:*:*:*:wordpress:*:* | ||
>= 2.7.0, < 2.7.2CPE matchmatch criteria | cpe:2.3:a:automattic:woocommerce_blocks:*:*:*:*:*:wordpress:*:* | ||
>= 2.8.0, < 2.8.1CPE matchmatch criteria | cpe:2.3:a:automattic:woocommerce_blocks:*:*:*:*:*:wordpress:*:* | ||
>= 2.9.0, < 2.9.1CPE matchmatch criteria | cpe:2.3:a:automattic:woocommerce_blocks:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.