CVE-2026-48971

MediumCVSS 4.3

Published: 27/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The WebToffee Product Import Export for WooCommerce plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 2.5.6.

Risk Assessment

Missing authorization may allow unauthorized users to perform import/export operations, risking data leakage or modification of store data. The risk affects sites running the vulnerable plugin version.

Recommendation

Update the Product Import Export for WooCommerce plugin to a version later than 2.5.6. Review role permissions and restrict access to import/export functionality.

Other vulnerabilities in Product Import Export for WooCommerce

CVE-2026-118989Medium
The Product Import Export for WooCommerce plugin in versions 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.

Original NVD description (English source)

Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Product Import Export for WooCommerce: from n/a through 2.5.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS