Servers and applications · WordPress plugins

CVE-2021-32790

WooCommerce: SQL Injection

Severity: Medium 4.9
Published: 13 Jul 2021
Last changed: 17 Jun 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 5.1.1, 5.2.3, 5.3.1, 5.4.2, 5.5.1, 6.6.0
Also known as: WPV-c29a671a61f6
Sources: NVD, WPVulnerability

Description

Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API.…

Affected software

Software Affected versions

Software	Affected versions
WooCommerceServers and applications · `cpe:a:woocommerce:woocommerce`	From 5.5.0 before 5.5.1 From 5.4.0 before 5.4.2 From 5.3.0 before 5.3.1 From 5.2.0 before 5.2.3 All 23 release lines From 3.3.0 before 3.3.6 From 3.4.0 before 3.4.8 From 3.5.0 before 3.5.9 From 3.6.0 before 3.6.6 From 3.7.0 before 3.7.2 From 3.8.0 before 3.8.2 From 3.9.0 before 3.9.4 From 4.0.0 before 4.0.2 From 4.1.0 before 4.1.2 From 4.2.0 before 4.2.3 From 4.3.0 before 4.3.4 From 4.4.0 before 4.4.2 From 4.5.0 before 4.5.3 From 4.6.0 before 4.6.3 From 4.7.0 before 4.7.2 From 4.8.0 before 4.8.1 From 4.9.0 before 4.9.3 From 5.0.0 before 5.0.1 From 5.1.0 before 5.1.1 From 5.2.0 before 5.2.3 From 5.3.0 before 5.3.1 From 5.4.0 before 5.4.2 From 5.5.0 before 5.5.1
WooCommerceWordPress plugins · `wp-plugin:woocommerce`	Every version before 6.6.0

WooCommerceServers and applications · cpe:a:woocommerce:woocommerce

From 5.5.0 before 5.5.1
From 5.4.0 before 5.4.2
From 5.3.0 before 5.3.1
From 5.2.0 before 5.2.3

All 23 release lines

From 3.3.0 before 3.3.6
From 3.4.0 before 3.4.8
From 3.5.0 before 3.5.9
From 3.6.0 before 3.6.6
From 3.7.0 before 3.7.2
From 3.8.0 before 3.8.2
From 3.9.0 before 3.9.4
From 4.0.0 before 4.0.2
From 4.1.0 before 4.1.2
From 4.2.0 before 4.2.3
From 4.3.0 before 4.3.4
From 4.4.0 before 4.4.2
From 4.5.0 before 4.5.3
From 4.6.0 before 4.6.3
From 4.7.0 before 4.7.2
From 4.8.0 before 4.8.1
From 4.9.0 before 4.9.3
From 5.0.0 before 5.0.1
From 5.1.0 before 5.1.1
From 5.2.0 before 5.2.3
From 5.3.0 before 5.3.1
From 5.4.0 before 5.4.2
From 5.5.0 before 5.5.1

WooCommerceWordPress plugins · wp-plugin:woocommerce

Every version before 6.6.0

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2021-32790
CVE.org https://www.cve.org/CVERecord?id=CVE-2021-32790
Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce/woocommerce-55-authenticated-blind-sql-injection