PT-2021-19934 · WordPress · Woocommerce

Josh · Published 2021-07-26 · Updated 2021-08-04 · CVE-2021-32790

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WooCommerce versions 3.3.0 through 3.3.5

Description An SQL injection issue affects WooCommerce sites running the plugin between versions 3.3.0 and 3.3.5. Malicious actors with admin access or API keys can exploit vulnerable endpoints such as "/wp-json/wc/v3/webhooks" and "/wp-json/wc/v2/webhooks". By carefully crafting the search parameter, information can be disclosed using timing and related attacks, although data will not be returned directly.

Recommendations For versions 3.3.0 through 3.3.5, upgrade to version 3.3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoints "/wp-json/wc/v3/webhooks" and "/wp-json/wc/v2/webhooks" to minimize the risk of exploitation. Avoid using the search parameter in the affected API endpoints until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-32790

GHSA-7VX5-X39W-Q24G

Affected Products

Woocommerce

References · 5

• https://github.com/woocommerce/woocommerce/security/advisories/GHSA-7vx5-x39w-q24g · Patch
• https://woocommerce.com/posts/critical-vulnerability-detected-july-2021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32790 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32790 · Vendor Advisory
• https://t.me/cibsecurity/26493 · Telegram Post