Server-Side Request Forgery in Product Import Export for WooCommerce by WordPress
CVE-2025-1912
7.6HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 March 2025
What is CVE-2025-1912?
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery. This vulnerability exists in all versions up to and including 2.5.0, specifically through the validate_file() function. Authenticated attackers with Administrator-level access can exploit this flaw to send web requests to arbitrary locations, potentially enabling them to query and modify sensitive internal services.
Affected Version(s)
Product Import Export for WooCommerce – Import Export Product CSV Suite * <= 2.5.0