5.1
Medium
CVE-2026-118989 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery…
Description
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Product Import Export for WooCommerce 2.5 | 2.5.1 → < 2.6.8 | 2.6.8 |
Other CVEs of Product Import Export for WooCommerce
The 4 CVEs of Product Import Export for WooCommerce →
CVE-2026-48971
Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly…
4.3
Medium
CVE-2024-30231
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This…
9.1
Critical
CVE-2024-22152
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This…
8.0
High