EUVD-2026-112727

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in downloadremotefile that allows shopmanager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal...

CVE-2026-118989

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in downloadremotefile that allows shopmanager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal...

CVE-2026-118989 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in downloadremotefile that allows shopmanager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal...

CVE-2026-118989

The WebToffee Product Import Export for WooCommerce plugin (versions 2.5.1 before 2.6.8 ) is vulnerable to a Server-Side Request Forgery (SSRF) in the download_remote_file function. This flaw allows users with shop_manager privileges to access internal services by submitting a .csv URL that initi...