# Order Export & Order Import for WooCommerce <= 2.7.9 - Authenticated (Shop Manager+) Server-Side Request Forgery via Import from URL

- **ID:** WPSEC-2026-1581
- **Plugin:** Order Export & Order Import for WooCommerce (`order-import-export-for-woocommerce`), https://wordpress.org/plugins/order-import-export-for-woocommerce/
- **Affected versions:** all versions before 2.8.0
- **Fixed in:** 2.8.0 (Update to 2.8.0 or later.)
- **Severity:** Medium 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-918
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-24)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/order-import-export-for-woocommerce
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1581/

## Description

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery via the import-from-URL feature in all versions up to, and including, 2.7.9. This is due to the user-supplied URL being fetched with wp_remote_get(), which does not block requests to private, loopback or link-local addresses or redirects to them. This makes it possible for authenticated attackers with import access, such as Shop Managers and above, to make web requests to arbitrary locations from the web application. This can be used to query and modify information from internal services.

## References

- https://wpsec.com/vuln/WPSEC-2026-1581/
- https://plugins.svn.wordpress.org/order-import-export-for-woocommerce/tags/2.8.0/
- https://wordpress.org/plugins/order-import-export-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1581/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.