Medium severity · published Oct 29, 2026
CVE-2026-118989
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects
New
5.5
CVSS
–
EPSS
No
On KEV
Description
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Product Import Export for WooCommerce · WebToffee
2.5.1 before 2.6.8 · source: vendor
Affected product
PI
Product Import Export for WooCommerce
WebToffee
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118989
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118989
patch
https://plugins.trac.wordpress.org/changeset/3766250/
technical-description
https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php#L563
technical-description
https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php#L661
product
https://wordpress.org/plugins/product-import-export-for-woo/
third-party-advisory
https://www.vulncheck.com/advisories/webtoffee-product-import-export-for-woocommerce-2.5.1-before-2.6.8-ssrf-via-redirects
More from Product Import Export for WooCommerce
7.6
CVE-2025-1912
Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
7.2
CVE-2025-1913
Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
7.2
CVE-2024-30231
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for WooCommerce: from n/a…
7.2
CVE-2024-22152
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for WooCommerce: from n/a…
6.5
CVE-2025-1911
Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function