Was my WooCommerce shop affected by CVE-2021-32789?
Short answer: WooCommerce 3.3 to 5.5 had this flaw until the July 2021 fixes. If your shop shows a WooCommerce version below the fixed release of its line (5.5.1 for 5.5, 5.4.2 for 5.4, and so on, see the table), it is potentially affected and should be updated. If your shop hides its WooCommerce version, we cannot tell. Paste your address below for a free check.
This is an earlier wave. We added this page afterwards as background; it was not published when the flaw was disclosed. Last updated: 26 October 2026.
What happened
On 13 July 2021 a security researcher reported a critical vulnerability in WooCommerce, the shop plugin for WordPress, through its bug bounty programme. The flaw was an SQL injection in the public Store API, the part of WooCommerce that serves product data to the shop pages. Anyone, without logging in, could use it to read data from the shop's database, such as admin account details.
WooCommerce patched every affected version, more than 90 releases of WooCommerce and the WooCommerce Blocks plugin, and from 14 July 2021 pushed the update to affected shops automatically. It said it believed any exploitation was limited, but advised shop owners to change admin passwords and rotate payment gateway and API keys.
The flaw is recorded as CVE-2021-32789. The same releases also fixed a smaller flaw, CVE-2021-32790, which needed admin access or API keys.
Which versions are fixed
| WooCommerce line | Fixed in |
|---|---|
| 5.5 | 5.5.1 |
| 5.4 | 5.4.2 |
| 5.3 | 5.3.1 |
| 5.2 | 5.2.3 |
| 5.1 | 5.1.1 |
| 5.0 | 5.0.1 |
| 4.9 | 4.9.3 |
| 4.8 | 4.8.1 |
| 4.7 | 4.7.2 |
| 4.6 | 4.6.3 |
| 4.5 | 4.5.3 |
| 4.4 | 4.4.2 |
| 4.3 | 4.3.4 |
| 4.2 | 4.2.3 |
| 4.1 | 4.1.2 |
| 4.0 | 4.0.2 |
| 3.9 | 3.9.4 |
| 3.8 | 3.8.2 |
| 3.7 | 3.7.2 |
| 3.6 | 3.6.6 |
| 3.5 | 3.5.9 |
| 3.4 | 3.4.8 |
| 3.3 | 3.3.6 |
| below 3.3 | not affected |
If you also run the separate WooCommerce Blocks plugin, it needed its own fixed release (from 2.5.16 up to 5.5.1, depending on its line). We cannot see the Blocks plugin version from outside.
What our check can and cannot tell you
We look at your shop from the outside, the way any visitor does. We read the WooCommerce version your pages show, from the generator tag or the version number on WooCommerce's script files, and compare it with the table above. We do not test the flaw.
- Potentially affected: your shop shows a version below the fixed release of its line. We say potentially because a version tag can be out of date or cached.
- Cannot tell: your shop runs WooCommerce but hides the version. Look under Plugins in the WordPress dashboard, or ask your developer.
- No sign of this problem: your shop shows a fixed version, a version older than 3.3, or no WooCommerce at all. This is "no sign from the outside", not a guarantee.
What to do
- Check your WooCommerce version under Plugins in the WordPress dashboard.
- Update to the current WooCommerce release. Make a backup first. A shop still on a 2021 version is missing years of other fixes too.
- Follow WooCommerce's advice from the time if your shop ran an affected version in July 2021: change admin passwords and rotate payment gateway and WooCommerce API keys.
- Run this check again after the update.
Official sources
- WooCommerce: Critical Vulnerability Detected in WooCommerce on July 13, 2021 – What You Need to Know
- WooCommerce Blocks security advisory for CVE-2021-32789: GHSA-6hq4-w6wv-8wrp
- WooCommerce security advisory for CVE-2021-32790: GHSA-7vx5-x39w-q24g
Scanylo is not affiliated with WooCommerce or Automattic. This page is a plain-language summary, not a replacement for the advisories. This is a passive, external check and not a penetration test.
Why this page exists
This is an earlier wave, kept on the wave radar as background. We added the page afterwards; it was not published when the flaw was disclosed on 2021-07-14. Sites that never updated can still be exposed, so the check still runs.
Every time a major vulnerability wave hits the news, Scanylo publishes a check page within 24 hours. Tick the email alert box above and we will re-check your site on every new wave and tell you the result. It is free and needs no account. The check is passive: we read the version your site shows to any visitor and nothing else. Methodology.