WordPress plugin
Product Import Export for WooCommerce – CSV Product Importer & Exporter security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 9 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High4
- Medium4
- Low1
All Product Import Export for WooCommerce – CSV Product Importer & Exporter vulnerabilities
- Medium6.42.6.8 - Authenticated (Shop Manager+) Server-Side Request Forgery
2.5.1 – <2.6.8Update to 2.6.8
- Medium4.3Missing Authorization
≤2.5.6Update to 2.5.7
- High7.2Authenticated (Admin+) PHP Object Injection via form_data Parameter
≤2.5.0Update to 2.5.1
- High7.6Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
≤2.5.0Update to 2.5.1
- Low2.7Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
≤2.5.0Update to 2.5.1
- Medium4.9Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
≤2.5.0Update to 2.5.1
- High7.2Authenticated(Shop Manager+) Arbitrary File Upload
≤2.4.1Update to 2.4.2
- High7.2Authenticated(Shop Manager+) Arbitrary File Upload via upload_import_file
≤2.3.7Update to 2.3.8
- Medium4.3Missing Authorization to CSV Import
<1.7.5Update to 1.7.5
Product Import Export for WooCommerce – CSV Product Importer & Exporter: common questions
Does Product Import Export for WooCommerce – CSV Product Importer & Exporter have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in Product Import Export for WooCommerce – CSV Product Importer & Exporter: 4 high, 4 medium, 1 low. None are known to affect version null.
How do I check which version of Product Import Export for WooCommerce – CSV Product Importer & Exporter I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Product Import Export for WooCommerce – CSV Product Importer & Exporter vulnerability?
CVE-2026-118989, published Oct 29, 2026: Product Import Export for WooCommerce – CSV Product Importer & Exporter 2.5.1 - 2.6.8 - Authenticated (Shop Manager+) Server-Side Request Forgery. Severity: Medium (CVSS 6.4).
Is any Product Import Export for WooCommerce – CSV Product Importer & Exporter vulnerability listed in CISA KEV?
No. None of the known Product Import Export for WooCommerce – CSV Product Importer & Exporter vulnerabilities is currently listed in the CISA KEV catalog.