CVE-2026-118989

MediumCVSS 5.5

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

The Product Import Export for WooCommerce plugin in versions 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.

Risk Assessment

A user with shop_manager privileges can leverage the server to probe and retrieve data from internal network resources, potentially disclosing information or facilitating further attacks.

Recommendation

Update the Product Import Export for WooCommerce plugin to version 2.6.8 or later. Restrict shop_manager privileges and the server's access to the internal network.

Other vulnerabilities in Product Import Export for WooCommerce

CVE-2026-48971Medium
The WebToffee Product Import Export for WooCommerce plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 2.5.6.

Original NVD description (English source)

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS