SQL Injection Affecting woocommerce/woocommerce package, versions >=5.5.0, <5.5.2 >=5.4.0, <5.4.2 >=5.3.0, <5.3.1 >=5.2.0, <5.2.3 >=5.1.0, <5.1.1 >=5.0.0, <5.0.1 >=4.9.0, <4.9.3 >=4.8.0, <4.8.1 >=4.7.0, <4.7.2 >=4.6.0, <4.6.3 >=4.5.0, <4.5.3 >=4.4.0, <4.4.2 >=4.3.0, <4.3.4 >=4.2.0, <4.2.3 >=4.1.0, <4.1.2 >=4.0.0, <4.0.2 >=3.9.0, <3.9.4 >=3.8.0, <3.8.2 >=3.7.0, <3.7.2 >=3.6.0, <3.6.6 >=3.5.0, <3.5.9 >=3.4.0, <3.4.8 <3.3.6


0.0
medium

Snyk CVSS

    Attack Complexity Low
    Privileges Required High
    Confidentiality High

    Threat Intelligence

    EPSS 0.07% (27th percentile)
Expand this section
NVD
4.9 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PHP-WOOCOMMERCEWOOCOMMERCE-1533590
  • published 27 Jul 2021
  • disclosed 27 Jul 2021
  • credit Unknown

How to fix?

Upgrade woocommerce/woocommerce to version 5.5.2, 5.4.2, 5.3.1, 5.2.3, 5.1.1, 5.0.1, 4.9.3, 4.8.1, 4.7.2, 4.6.3, 4.5.3, 4.4.2, 4.3.4, 4.2.3, 4.1.2, 4.0.2, 3.9.4, 3.8.2, 3.7.2, 3.6.6, 3.5.9, 3.4.8, 3.3.6 or higher.

Overview

woocommerce/woocommerce is an eCommerce toolkit that helps you sell anything.

Affected versions of this package are vulnerable to SQL Injection. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of /wp-json/wc/v3/webhooks, /wp-json/wc/v2/webhooks and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting search parameter information can be disclosed using timing and related attacks.