CVE-2021-32789

Description

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.

Weakness classification

• security-advisories@github.com: CWE-89
• nvd@nist.gov: CWE-89

Primary references

• security-advisories@github.com — Broken Link
• security-advisories@github.com — Patch, Third Party Advisory
• security-advisories@github.com — Permissions Required
• security-advisories@github.com — Vendor Advisory
• security-advisories@github.com — Permissions Required
• af854a3a-2127-422b-91ae-364da2661108 — Broken Link
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Permissions Required
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Permissions Required