{
 "id": "WPSEC-2026-1728",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1728/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1728/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1728/index.md",
 "title": "Product Import Export for WooCommerce – Import Export Product CSV Suite <= 2.6.7 - Unauthenticated Sensitive Information Exposure via Predictable Export File Names",
 "description": "The Product Import Export for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.7. This is due to export files being written to wp-content/webtoffee_export under predictable names made up only of the export type and a timestamp, with only an Apache .htaccess file blocking direct access. This makes it possible for unauthenticated attackers on servers that ignore .htaccess (such as Nginx) to guess the names of exported CSV files and download them directly. The exposed data can include product data and the email addresses of product reviewers. Exploitation requires that an administrator or shop manager has generated an export, and that the attacker can estimate when it was created.",
 "plugin": {
  "slug": "product-import-export-for-woo",
  "name": "Product Import Export for WooCommerce – Import Export Product CSV Suite",
  "full_name": "Product Import Export for WooCommerce – CSV Product Importer & Exporter",
  "wordpress_org": "https://wordpress.org/plugins/product-import-export-for-woo/",
  "advisories_url": "https://wpsec.com/vuln/plugin/product-import-export-for-woo/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/product-import-export-for-woo"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-330"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.6.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.6.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.6.8",
 "remediation": "Update to 2.6.8 or later.",
 "fix_released": "2026-10-26T11:18:54+00:00",
 "published": "2026-10-27T11:50:51+00:00",
 "updated": "2026-10-26T13:21:09.968111+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1728/",
  "https://plugins.svn.wordpress.org/product-import-export-for-woo/tags/2.6.8/",
  "https://wordpress.org/plugins/product-import-export-for-woo/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/product-import-export-for-woo",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}