Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

CVE-2021-32789 — AI Deep Analysis Summary

CVSS 7.5 · High

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A SQL Injection (SQLi) flaw in WooCommerce Blocks. 📉 **Consequences**: Attackers can execute read-only SQL queries via crafted URLs, potentially leaking sensitive site data like user credentials.

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-89** (SQL Injection).…

Q3Who is affected? (Versions/Components)

🎯 **Affected**: WordPress sites using **WooCommerce Blocks** plugin. Versions **2.5.0** up to (but not including) **2.5.16** are vulnerable. 📦 Component: `woocommerce-gutenberg-products-block`.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Capabilities**: Can perform **read-only** SQL queries. 🗄️ Risks include dumping admin users, extracting table structures, and leaking database content. No write access or system command execution is implied.

Q5Is exploitation threshold high? (Auth/Config)

⚠️ **Exploitation Threshold**: **Low**. The CVSS vector shows `PR:N` (No Privileges Required) and `UI:N` (No User Interaction).…

Q6Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exploits**: **Yes**. Multiple PoCs exist on GitHub (e.g., `and0x00`, `DonVorrin`). Tools like `woo` can dump admin users instantly. 🌐 Wild exploitation is possible via automated scanners like Nuclei.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for the vulnerable endpoint: `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]`.…

Q8Is it fixed officially? (Patch/Mitigation)

🔧 **Official Fix**: **Yes**. Upgrade the WooCommerce Blocks plugin to version **2.5.16** or later. 📢 The vendor (WooCommerce) released patches and an incident report on July 14, 2021.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: If you cannot upgrade immediately, **disable** the WooCommerce Blocks feature plugin or restrict access to the `/wc/store/` API endpoints via firewall/WAF rules until patched.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. CVSS Score is **7.5** (High). Since it requires no authentication and allows data exfiltration, patch immediately. ⏳ Delay increases the risk of data breaches.