SQL Injection Vulnerability in WooCommerce Plugins of WordPress

Languages: English. Risk Level: High.

Components Affected

✻ WordPress WooCommerce Plugin version 3.3 to 5.5

✻ WordPress WooCommerce Block version 2.5 to 5.5

Overview

A vulnerability has been identified in the WooCommerce plugin of WordPress which could allow an attacker to perform SQL injection attacks on a targeted system.

Description

This vulnerability exists in the WooCommerce plugin due to the improper injection of search parameters into a SQL query by a webhook search function. An attacker could exploit this vulnerability just by entering especially crafted SQL queries on the targeted system.

Successful exploitation of this vulnerability could allow an attacker to perform SQL injections and access sensitive information on the targeted system.

Impact

✻ Expose sensitive information

✻ Service disruption

Solution/ Workarounds

Apply the relevant update as mentioned in the WooCommerce advisory

Critical Vulnerability Detected in WooCommerce on July 13, 2021

Reference

Critical Vulnerability Detected in WooCommerce on July 13, 2021

WooCommerce fixes vulnerability exposing 5 million sites to data theft

Critical SQL Injection Vulnerability Patched in WooCommerce

Indian Computer Emergency Response Team

Disclaimer