TI-2026-82358 Aliases CVE-2026-118989 GHSA-j2r3-9f4h-g98h

Server-side request forgery in WebToffee Product Import Export for WooCommerce

LOW 23CWE-918Published 2026-10-29 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

WebToffee Product Import Export for WooCommerce from 2.5.1 before 2.6.8 contains a server-side request forgery flaw in download_remote_file (CWE-918). An authenticated attacker with the shop_manager role can submit a .csv URL that redirects to an internal address, so the server fetches internal responses and returns them as import data. The CVSS 4.0 vector requires high privileges and no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00267 18th percentileScored 2026-11-07

Fix Fixed Product Import Export for WooCommerce (WebToffee): 2.6.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WebToffee	Product Import Export for WooCommerce	2.5.1 to before 2.6.8	2.6.8	Patch available	CNA

Product Import Export for WooCommerce VendorWebToffee Affected 2.5.1 to before 2.6.8 Fixed in 2.6.8 Patch available CNA

Remediation

Update WebToffee Product Import Export for WooCommerce to version 2.6.8 or later, which is the fixed version. The sources do not list a vendor advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA Product Import Export for WooCommerce (WebToffee) Fixed in 2.6.8

Timeline

2026-10-29 Threatist record created from CVE-2026-118989
2026-10-29 CISA SSVC decision points changed
2026-10-29 Alias added: GHSA-j2r3-9f4h-g98h

References

Patch 1

Changeset 3766250

Other 3

TI-2024-07682 GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF CVSS 3.1MEDIUM 6.5
TI-2024-07785 GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS CVSS 3.1MEDIUM 5.4
TI-2024-20216 WordPress Export and Import Users and Customers plugin <= 2.5.2 - Path Traversal vulnerability CVSS 3.1MEDIUM 4.3
TI-2024-00649 Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
TI-2023-02962 Stripe Payment Plugin for WooCommerce <= 3.7.7 - Authentication Bypass CVSS 3.1CRITICAL 9.8
TI-2022-23148 WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection CVSS 3.1CRITICAL 9.8

See all 68 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences