Vulnerability Description
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.
- https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.
- https://plugins.trac.wordpress.org/changeset/3766250/
- https://wordpress.org/plugins/product-import-export-for-woo/
- https://www.vulncheck.com/advisories/webtoffee-product-import-export-for-woocomm
FAQ
What is CVE-2026-118989?
CVE-2026-118989 is a vulnerability with a CVSS score of 5.5 (MEDIUM). WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal service...
How severe is CVE-2026-118989?
CVE-2026-118989 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-118989?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.