{"id":"CVE-2021-32789","aliases":["EUVD-2021-19552","GHSA-6hq4-w6wv-8wrp"],"status":"published","title":"Arbitrary SQL (SQL injection) possible via the Store API component.","description":"woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.17227,"percentile":0.97122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2021-07-26T15:30:12Z","modified":"2026-10-20T10:54:44Z","exploits":[{"source":"nuclei","id":"CVE-2021-32789","title":"WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32789.yaml"},{"source":"pocgithub","id":"DonVorrin/CVE-2021-32789","title":"DonVorrin/CVE-2021-32789","date":"2024-02-08","url":"https://github.com/DonVorrin/CVE-2021-32789"},{"source":"pocgithub","id":"and0x00/CVE-2021-32789","title":"and0x00/CVE-2021-32789","date":"2023-02-17","url":"https://github.com/and0x00/CVE-2021-32789"}],"products":[{"vendor":"automattic","product":"woocommerce_blocks"},{"vendor":"woocommerce","product":"woocommerce-gutenberg-products-block"}],"references":[{"url":"https://github.com/woocommerce/woocommerce-gutenberg-products-block/security/advisories/GHSA-6hq4-w6wv-8wrp","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/woocommerce/woocommerce-gutenberg-products-block-ghsa-6hq4-w6wv-8wrp/pull/1","tags":["x_refsource_MISC","x_transferred","Broken Link","fix"]},{"url":"https://hackerone.com/reports/1260787","tags":["x_refsource_MISC","x_transferred","Permissions Required","report"]},{"url":"https://woocommerce.com/posts/critical-vulnerability-detected-july-2021/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://wooengineering.wordpress.com/2021/07/14/incident-report-sql-injection-via-store-api/","tags":["x_refsource_MISC","x_transferred","Permissions Required","report"]}],"sources":{"cve":[{"id":"CVE-2021-32789","title":"Arbitrary SQL (SQL injection) possible via the Store API component.","description":"woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.","status":"published","published":"2021-07-26T15:30:12Z","modified":"2024-08-03T23:33:56.078Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:33:06.658806Z"}],"euvd":[{"id":"EUVD-2021-19552","description":"woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.","status":"published","published":"2021-07-26T15:30:12Z","modified":"2024-08-03T23:33:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T03:24:35.30045Z"}],"nvd":[{"id":"CVE-2021-32789","description":"woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.","status":"published","published":"2021-07-26T16:15:07.743Z","modified":"2026-06-17T03:53:37.987Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"CVE-2021-32789","description":"woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.","status":"published","published":"2021-07-26T16:15:07.743Z","modified":"2026-10-20T10:54:44.300851284Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.793849Z"}]}}