{"id":"CVE-2026-118989","title":"WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects","summary":"WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"WebToffee","product":"Product Import Export for WooCommerce","affected":["product_import_export_for_woocommerce >= 2.5.1 < 2.6.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T12:19:06.542480Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T12:36:53.008Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118989","references":[{"url":"https://plugins.trac.wordpress.org/changeset/3766250/","label":"Changeset 3766250"},{"url":"https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php#L563"},{"url":"https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php#L661"},{"url":"https://wordpress.org/plugins/product-import-export-for-woo/"},{"url":"https://www.vulncheck.com/advisories/webtoffee-product-import-export-for-woocommerce-2.5.1-before-2.6.8-ssrf-via-redirects","label":"VulnCheck Advisory: WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects"}],"tags":["cve.org"],"epss":0.00267,"epssPercentile":0.18975,"ingestedAt":"2026-11-01T18:59:04.467Z","slug":"CVE-2026-118989","body":"## Overview\n\nWebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.\n\n## Affected\n\n- `product_import_export_for_woocommerce >= 2.5.1 < 2.6.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}