Vulnerabilities / Order Export & Order Import for WooCommerce / WPSEC-2026-1581
Order Export & Order Import for WooCommerce <= 2.7.9 - Authenticated (Shop Manager+) Server-Side Request Forgery via Import from URL
Medium 5.5
CWE-918Fixed in 2.8.0
- ID
- WPSEC-2026-1581
- Plugin
- Order Export & Order Import for WooCommerce (order-import-export-for-woocommerce)
- Affected
- all versions before 2.8.0
- Remediation
- Update to 2.8.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-918
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-24
- Attack surface
- Order Export & Order Import for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery via the import-from-URL feature in all versions up to, and including, 2.7.9. This is due to the user-supplied URL being fetched with wp_remote_get(), which does not block requests to private, loopback or link-local addresses or redirects to them. This makes it possible for authenticated attackers with import access, such as Shop Managers and above, to make web requests to arbitrary locations from the web application. This can be used to query and modify information from internal services.
References
- https://wpsec.com/vuln/WPSEC-2026-1581/
- https://plugins.svn.wordpress.org/order-import-export-for-woocommerce/tags/2.8.0/
- https://wordpress.org/plugins/order-import-export-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS