CVE-2025-64382

MediumCVSS 4.3

Published: 13/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The Order Export & Order Import plugin for WooCommerce has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.6.7.

Risk Assessment

Unauthorized individuals may gain access to order export/import functionality, potentially leading to leakage or manipulation of order data.

Recommendation

Update the plugin to a patched version. Review permission configuration and ensure only trusted users have access to these functions.

Other vulnerabilities in Order Export & Order Import for WooCommerce

CVE-2026-94375Medium
The Order Export & Order Import for WooCommerce plugin is vulnerable to Sensitive Information Exposure in all versions up to and including 2.7.8. Unauthenticated attackers can download exported order CSV files containing customer PII if the .htaccess and index.php guard files are missing from the export directory.

Original NVD description (English source)

Missing Authorization vulnerability in WebToffee Order Export & Order Import for WooCommerce order-import-export-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Export & Order Import for WooCommerce: from n/a through <= 2.6.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS