Product Import Export for WooCommerce – Import Export Product CSV Suite <= 2.6.7 - Unauthenticated Sensitive Information Exposure via Predictable Export File Names
- ID
- WPSEC-2026-1728
- Plugin
- Product Import Export for WooCommerce – CSV Product Importer & Exporter (product-import-export-for-woo)
- Affected
- all versions before 2.6.8
- Remediation
- Update to 2.6.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-330
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Product Import Export for WooCommerce – Import Export Product CSV Suite on WPSec AttackSurface
- Fix released
- Published
Description
The Product Import Export for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.7. This is due to export files being written to wp-content/webtoffee_export under predictable names made up only of the export type and a timestamp, with only an Apache .htaccess file blocking direct access. This makes it possible for unauthenticated attackers on servers that ignore .htaccess (such as Nginx) to guess the names of exported CSV files and download them directly. The exposed data can include product data and the email addresses of product reviewers. Exploitation requires that an administrator or shop manager has generated an export, and that the attacker can estimate when it was created.
References
- https://wpsec.com/vuln/WPSEC-2026-1728/
- https://plugins.svn.wordpress.org/product-import-export-for-woo/tags/2.6.8/
- https://wordpress.org/plugins/product-import-export-for-woo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS