CVE-2026-118989 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects

Medium 5.1 Published 29 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-118989?

CVE-2026-118989 is a medium-severity vulnerability in WebToffee Product Import Export for WooCommerce, published on 29 Oct 2026.

Official description

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.

Weakness: CWE-918

Which versions are affected by CVE-2026-118989?

How do I fix CVE-2026-118989?

No fix has been published for CVE-2026-118989 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-118989 being exploited?

There is no known exploitation of CVE-2026-118989 in the wild and no public exploit code.

Sources

Also known as GHSA-j2r3-9f4h-g98h.