CVE-2021-32789: 
WordPress vulnerability analysis and mitigation

An SQL injection vulnerability (CVE-2021-32789) was discovered in WooCommerce and its WooCommerce Blocks feature plugin on July 13, 2021. The vulnerability affected all WooCommerce sites running versions between 3.3 and 5.5, as well as the WooCommerce Blocks feature plugin between versions 2.5.0 and prior to 5.5.1. The issue was responsibly disclosed by security researcher Josh via the HackerOne security program (WooCommerce Blog, WPScan).

The vulnerability allowed for unauthenticated SQL injection attacks through the wc/store/products/collection-data endpoint, specifically via the calculateattributecounts[][taxonomy] parameter. The vulnerability received a CVSS score of 9.8 (Critical), indicating its severe nature. The issue allowed execution of read-only SQL queries that could potentially expose sensitive information from the database (GitHub Advisory).

If exploited, the vulnerability could allow attackers to access sensitive information stored in the WordPress database, including order details, customer information, and administrative data. While passwords were protected by WordPress's salted hash system, making them difficult to crack, other sensitive information such as API keys and payment gateway credentials could have been exposed (WooCommerce Blog).

The vulnerability was patched in multiple versions, including WooCommerce 5.5.1 and various backported versions. Automatic updates were deployed to vulnerable stores. Recommended mitigation steps included updating to the latest patched version, changing administrator passwords, and rotating any payment gateway and WooCommerce API keys. For WooCommerce Blocks, users were advised to update to version 5.5.1 or higher (WooCommerce Blog).

WooCommerce immediately responded to the disclosure by conducting a thorough investigation and deploying automatic updates to affected stores. The company maintained transparent communication through their blog and social media channels, including Twitter announcements to alert users about the critical nature of the update (WPScan).