WordPress plugin
Order Export & Order Import for WooCommerce security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 9 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High5
- Medium3
- Low1
All Order Export & Order Import for WooCommerce vulnerabilities
- Medium5.3Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
≤2.7.8Update to 2.7.9
- Medium4.3Missing Authorization
≤2.6.7Update to 2.6.8
- Medium4.9Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
≤2.6.0Update to 2.6.1
- High7.2Authenticated (Admin+) PHP Object Injection via form_data Parameter
≤2.6.0Update to 2.6.1
- Low2.7Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
≤2.6.0Update to 2.6.1
- High7.6Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
≤2.6.0Update to 2.6.1
- High7.2Authenticated (Administrator+) PHP Object Injection
≤2.4.9Update to 2.5.0
- High7.2Authenticated (Shop Manager+) Arbitrary File Upload via upload_import_file
≤2.4.3Update to 2.4.4
- High8.8Arbitrary User Creation
<1.3.9Update to 1.3.9
Order Export & Order Import for WooCommerce: common questions
Does Order Export & Order Import for WooCommerce have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in Order Export & Order Import for WooCommerce: 5 high, 3 medium, 1 low. None are known to affect version null.
How do I check which version of Order Export & Order Import for WooCommerce I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Order Export & Order Import for WooCommerce vulnerability?
CVE-2026-94375, published Oct 9, 2026: Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path(). Severity: Medium (CVSS 5.3).
Is any Order Export & Order Import for WooCommerce vulnerability listed in CISA KEV?
No. None of the known Order Export & Order Import for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.