Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.5
CVSSv3

CVE-2021-32789

Published: 26/07/2021 Updated: 05/08/2021
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Woocommerce Blocks

Vulnerability Summary

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

automattic woocommerce blocks

Github Repositories

https://github.com/and0x00/CVE-2021-32789

💣 Wordpress WooCommerce users dump exploit

💣 CVE-2021-32789 Wordpress WooCommerce users dump exploit Dump admin user woo -u examplecom Dump all users woo -u examplecom -dump

https://github.com/DonVorrin/CVE-2021-32789

Authenticated Blind SQL Injection. Wordpress woocommerce plugin versions >= 2.5.0

CVE-2021-32789 Authenticated Blind SQL Injection Wordpress woocommerce plugin versions >= 250 Install git clone githubcom/DonVorrin/CVE-2021-32789git cd CVE-2021-32789 sudo pip install -r requirementstxt Exploit python3 exploitpy Enter URL: (Example: exploitcve/) Enter number: 1 - Output tables

References

CWE-89https://github.com/woocommerce/woocommerce-gutenberg-products-block/security/advisories/GHSA-6hq4-w6wv-8wrphttps://wooengineering.wordpress.com/2021/07/14/incident-report-sql-injection-via-store-api/https://woocommerce.com/posts/critical-vulnerability-detected-july-2021/https://github.com/woocommerce/woocommerce-gutenberg-products-block-ghsa-6hq4-w6wv-8wrp/pull/1https://hackerone.com/reports/1260787https://nvd.nist.govhttps://github.com/and0x00/CVE-2021-32789
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
firmwareCVE-2023-52866CVE-2024-4367CVE-2024-1721CVE-2023-34992XML injectionCVE-2023-52817SQLCVE-2023-52855
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook