Live › vulnerability › CVE-2026-118989
WebToffee Product Import Export for WooCommerce versions 2.5.1 before 2.6.8 fetches remote CSV files without checking redirects. A shop_manager account can make the server request internal addresses and read the responses as import data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
Sites running WebToffee Product Import Export for WooCommerce from 2.5.1 up to but not including 2.6.8 that let shop_manager accounts run product imports. The flaw follows redirects from a submitted CSV URL to internal addresses, so exposure depends on the server having reachable internal services. Sites on 2.6.8 or later, or sites that do not use the importer, can skip it.
No product ranges from the sources yet.
wp plugin get <plugin-slug> and see whether it is below 2.6.8.2.6.8 or later (the sources name this as the fixed version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
This page as .md · .json · in your agent: get_signal("CVE-2026-118989")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.