Server-Side Request Forgery in WebToffee Product Import Export for WooCommerce
CVE-2026-118989

5.1MEDIUM

Key Information:

Vendor

Webtoffee

Status
Product Import Export For WooCommerce
Vendor
CVE Published:
29 October 2026

What is CVE-2026-118989?

The WebToffee Product Import Export for WooCommerce plugin versions 2.5.1 through 2.6.7 has a server-side request forgery (SSRF) vulnerability due to improper handling of URLs in the download_remote_file function. This flaw allows shop_manager users to submit a .csv URL that results in an HTTP 302 redirect to internal services. Consequently, attackers could exploit this vulnerability to have the server fetch internal data, potentially exposing sensitive information by returning it as import data. Users are encouraged to upgrade to version 2.6.8 or later to mitigate this risk.

Affected Version(s)

Product Import Export for WooCommerce 2.5.1 < 2.6.8

References

https://plugins.trac.wordpress.org/changeset/3766250/
patch
https://plugins.trac.wordpress.org/browser/product-import...
technical-description
https://plugins.trac.wordpress.org/browser/product-import...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sarvar Eshboyev
.