5.1
Moyenne
CVE-2026-118989 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery…
Description
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Product Import Export for WooCommerce 2.5 | 2.5.1 → < 2.6.8 | 2.6.8 |
Autres CVE de Product Import Export for WooCommerce
Les 4 CVE de Product Import Export for WooCommerce →
CVE-2026-48971
Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly…
4.3
Moyenne
CVE-2024-30231
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This…
9.1
Critique
CVE-2024-22152
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This…
8.0
Élevée