WordPress plugin
Product Import Export for WooCommerce – CSV Product Importer & Exporter security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 9 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High4
- Medium4
- Low1
All Product Import Export for WooCommerce – CSV Product Importer & Exporter vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Authenticated (Admin+) PHP Object Injection via form_data Parameter ≤2.5.0Update to 2.5.1 | CVE-2025-1913 | |
| High7.6 | Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function ≤2.5.0Update to 2.5.1 | CVE-2025-1912 | |
| High7.2 | Authenticated(Shop Manager+) Arbitrary File Upload ≤2.4.1Update to 2.4.2 | CVE-2024-30231 | |
| High7.2 | Authenticated(Shop Manager+) Arbitrary File Upload via upload_import_file ≤2.3.7Update to 2.3.8 | CVE-2024-22152 |
- High7.2Authenticated (Admin+) PHP Object Injection via form_data Parameter
≤2.5.0Update to 2.5.1
- High7.6Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
≤2.5.0Update to 2.5.1
- High7.2Authenticated(Shop Manager+) Arbitrary File Upload
≤2.4.1Update to 2.4.2
- High7.2Authenticated(Shop Manager+) Arbitrary File Upload via upload_import_file
≤2.3.7Update to 2.3.8
Product Import Export for WooCommerce – CSV Product Importer & Exporter: common questions
Does Product Import Export for WooCommerce – CSV Product Importer & Exporter have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in Product Import Export for WooCommerce – CSV Product Importer & Exporter: 4 high, 4 medium, 1 low. None are known to affect version null.
How do I check which version of Product Import Export for WooCommerce – CSV Product Importer & Exporter I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Product Import Export for WooCommerce – CSV Product Importer & Exporter vulnerability?
CVE-2026-118989, published Oct 29, 2026: Product Import Export for WooCommerce – CSV Product Importer & Exporter 2.5.1 - 2.6.8 - Authenticated (Shop Manager+) Server-Side Request Forgery. Severity: Medium (CVSS 6.4).
Is any Product Import Export for WooCommerce – CSV Product Importer & Exporter vulnerability listed in CISA KEV?
No. None of the known Product Import Export for WooCommerce – CSV Product Importer & Exporter vulnerabilities is currently listed in the CISA KEV catalog.