{"id":"CVE-2026-118989","kind":"vulnerability","aliases":["CVE-2026-118989"],"related":[],"title":"WebToffee WooCommerce import plugin: redirect lets shop managers reach internal services","description":"WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.","summary":"WebToffee Product Import Export for WooCommerce versions 2.5.1 before 2.6.8 fetches remote CSV files without checking redirects. A shop_manager account can make the server request internal addresses and read the responses as import data.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","webtoffee","woocommerce","wordpress"],"not_affected_if":["fixed-version","no-import-feature-used"],"how_to_check":"- Check the installed version of WebToffee Product Import Export for WooCommerce in the WordPress plugins screen or `wp plugin get <plugin-slug>` and see whether it is below `2.6.8`.","fix":"- WebToffee Product Import Export for WooCommerce: `2.6.8` or later (the sources name this as the fixed version).","status":"open","published_at":"2026-10-29T11:17:32+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","triaged_at":"2026-10-29T11:25:38+00:00","updated_at":"2026-10-29T11:25:38+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-29T11:25:38Z","model":"claude-haiku-5-5","output":{"fix":"- WebToffee Product Import Export for WooCommerce: `2.6.8` or later (the sources name this as the fixed version).","reach":"network","title":"WebToffee WooCommerce import plugin: redirect lets shop managers reach internal services","impact":"medium","summary":"WebToffee Product Import Export for WooCommerce versions 2.5.1 before 2.6.8 fetches remote CSV files without checking redirects. A shop_manager account can make the server request internal addresses and read the responses as import data.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","woocommerce","webtoffee","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads internal service responses through the import feature","analyst_note":"","how_to_check":"- Check the installed version of WebToffee Product Import Export for WooCommerce in the WordPress plugins screen or `wp plugin get <plugin-slug>` and see whether it is below `2.6.8`.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-import-feature-used"],"who_is_affected":"Sites running WebToffee Product Import Export for WooCommerce from 2.5.1 up to but not including 2.6.8 that let shop_manager accounts run product imports. The flaw follows redirects from a submitted CSV URL to internal addresses, so exposure depends on the server having reachable internal services. Sites on 2.6.8 or later, or sites that do not use the importer, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4159,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118989':14A,17A '-2026':13A,16A '2.5.1':32B,66C '2.6.8':34B,68C '302':102C 'account':45B 'address':52B,107C 'allow':82C 'attack':92C 'caus':108C 'check':40B 'contain':69C 'csv':37B,96C 'cve':12A,15A 'data':59B,120C 'download':78C 'export':28B,63C 'fetch':35B,112C 'file':38B,80C 'forgeri':75C 'host':21B 'http':101C 'import':3A,27B,58B,62C,119C 'intern':10A,51B,88C,106C,113C 'let':6A 'make':47B 'manag':8A,44B,84C 'plugin':4A 'product':26B,61C 'reach':9A,87C 'read':54B 'redirect':5A,41B,91C,103C 'remot':36B,79C 'request':50B,74C 'respons':56B,114C 'return':99C,116C 'runtim':18B 'self':20B 'self-host':19B 'server':49B,72C,110C 'server-sid':71C 'servic':11A,89C 'shop':7A,43B,83C 'side':73C 'submit':94C 'url':97C 'user':85C 'version':31B 'via':90C 'vulner':76C 'webtoffe':1A,22B,25B,60C 'without':39B 'woocommerc':2A,23B,30B,65C 'wordpress':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running WebToffee Product Import Export for WooCommerce from 2.5.1 up to but not including 2.6.8 that let shop_manager accounts run product imports. The flaw follows redirects from a submitted CSV URL to internal addresses, so exposure depends on the server having reachable internal services. Sites on 2.6.8 or later, or sites that do not use the importer, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T11:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118989","severity":null,"published_at":"2026-10-29T11:17:32+00:00","modified_at":"2026-10-29T11:17:32+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","fetched_at":"2026-10-29T11:24:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}