--- id: "CVE-2026-118989" kind: "vulnerability" aliases: ["CVE-2026-118989"] title: "WebToffee WooCommerce import plugin: redirect lets shop managers reach internal services" severity: "medium" cvss: 5.5 epss: null exploited: false status: "open" category: "runtime" products: [] ecosystems: [] tags: ["runtime", "self-hosted", "webtoffee", "woocommerce", "wordpress"] not_affected_if: ["fixed-version", "no-import-feature-used"] published_at: "2026-10-29T11:17:32+00:00" first_seen_at: "2026-10-29T11:24:28+00:00" updated_at: "2026-10-29T11:25:38+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118989", "first_seen_at": "2026-10-29T11:24:28+00:00"}] --- # WebToffee WooCommerce import plugin: redirect lets shop managers reach internal services WebToffee Product Import Export for WooCommerce versions 2.5.1 before 2.6.8 fetches remote CSV files without checking redirects. A shop_manager account can make the server request internal addresses and read the responses as import data. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Check the installed version of WebToffee Product Import Export for WooCommerce in the WordPress plugins screen or `wp plugin get ` and see whether it is below `2.6.8`. ## Fix - WebToffee Product Import Export for WooCommerce: `2.6.8` or later (the sources name this as the fixed version). ## Timeline - 2026-10-29T11:24:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118989 ## From the sources WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_