# CVE-2026-118989: WebToffee Product Import Export for WooCommerce server-side request forgery

Source: https://junglewise.ai/threats/cve-2026-118989-webtoffee-product-import-export-for-woocommerce-2-5-1-before-2-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-118989 · Severity: medium · CVSS 5.5 · Published 2026-10-29

WebToffee Product Import Export is a WordPress plugin that allows shop managers to import product data into WooCommerce stores. A server-side request forgery (SSRF) vulnerability in versions before 2.6.8 allows authenticated shop_manager users to manipulate the import process to access internal network services and retrieve sensitive data by exploiting HTTP redirects.

Vendors: [WebToffee](https://junglewise.ai/threats/vendors/webtoffee).

## Quick answers

**Is CVE-2026-118989 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118989 being exploited in the wild.

**How severe is CVE-2026-118989?** Medium severity, with a CVSS score of 5.5, published 29 October 2026.

**Which products and versions are affected?** WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8.

**Is there a fix for CVE-2026-118989?** Yes: fixed in 2.6.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118989 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-118989?** Check whether you run WebToffee Product Import Export for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.6.8

## Technical details

The vulnerability exists in the download_remote_file function, which fails to validate redirect targets when fetching CSV import files. An authenticated shop_manager can submit a malicious CSV URL that returns an HTTP 302 redirect to an internal service (e.g., metadata endpoints, internal APIs); the server follows the redirect and returns the internal response as import data. This is a classic SSRF attack requiring shop_manager-level authentication and user interaction to submit the crafted URL.

## Affected products

- WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8

## Timeline

- 2026-10-29: disclosed

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php](https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php)

## Related threats

- [WebToffee Product Import Export for WooCommerce missing authorization](https://junglewise.ai/threats/cve-2026-48971-webtoffee-product-import-export-for-woocommerce-missing)