Is CVE-2021-32790 actively exploited?

Yes. CVE-2021-32790 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2021-32790 be exploited remotely?

The attack vector of CVE-2021-32790 has not been classified yet.

What is the CVSS score of CVE-2021-32790?

CVE-2021-32790 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2021-32790

UNKNOWNCISA KEVIN THE WILD

CVE-2021-32790

Published: April 11, 2026

EPSS:2.01%probability of exploitation in 30 daysPercentile:83.7th

Official Description

Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading.

NVD Source

Risk Analysis

WooCommerce plugin versions between 3.3.0 and 3.3.6 are affected by an SQL injection vulnerability. Malicious actors with existing admin access or API keys can exploit webhook listing API endpoints to execute read-only SQL queries. While data is not directly returned, information can be disclosed through timing and related attacks, making this a serious concern due to confirmed exploitation.

This vulnerability is actively being exploited in the wild, confirming that attackers are leveraging this flaw. Exploitation requires existing admin access or API keys, indicating a more targeted attack vector.

Recommended Action

Upgrade WooCommerce to version 3.3.6 or later to address this SQL injection vulnerability. There are no known workarounds aside from upgrading the plugin.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2021-32790 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2021-32790 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.