CVE-2025-1912

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/import/classes/class-import-ajax.php#L175	Product
https://plugins.trac.wordpress.org/changeset/3261194/	Patch
https://wordpress.org/plugins/product-import-export-for-woo/#developers	Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/406b52dc-3d36-4b03-a932-34f456395979?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:webtoffee:product_import_export_for_woocommerce:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2025-03-26 12:15

Updated : 2025-07-09 16:49

NVD link : CVE-2025-1912

Mitre link : CVE-2025-1912

CVE.ORG link : CVE-2025-1912

JSON object : View

Products Affected

webtoffee

product_import_export_for_woocommerce

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-1912", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.3}]}, "published": "2025-03-26T12:15:15.353", "references": [{"url": "https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/import/classes/class-import-ajax.php#L175", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3261194/", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://wordpress.org/plugins/product-import-export-for-woo/#developers", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/406b52dc-3d36-4b03-a932-34f456395979?source=cve", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "The Product Import Export for WooCommerce \u2013 Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El complemento Product Import Export for WooCommerce \u2013 Import Export Product CSV Suite para WordPress es vulnerable a Server-Side Request Forgery en todas las versiones hasta la 2.5.0 incluida, a trav\u00e9s de la funci\u00f3n validate_file(). Esto permite a atacantes autenticados, con acceso de administrador o superior, realizar solicitudes web a ubicaciones arbitrarias desde la aplicaci\u00f3n web y utilizarlas para consultar y modificar informaci\u00f3n de servicios internos."}], "lastModified": "2025-07-09T16:49:31.477", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:webtoffee:product_import_export_for_woocommerce:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "20BB9A46-07D4-49F8-B399-8B34D8658A4B", "versionEndExcluding": "2.5.1"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}