Product Import Export CVE-2026-118989

Exploitation requires an authenticated WooCommerce user with the shop_manager role (PR:H) and access to the plugin's product import feature. The specific trigger is the download_remote_file routine's handling of a supplied .csv URL that returns an HTTP 302 redirect to an internal address; the server follows the redirect and returns the internal response as import data. Affected versions are 2.5.1 up to but not including 2.6.8. Limiting factors: the attacker must already possess shop_manager privileges (no unauthenticated path), and impact is constrained to retrieval of internal responses (VC:L/VI:L) rather than code execution or full data compromise.

This is a genuinely moderate, not critical, issue - the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes a network-reachable, low-complexity flaw that nonetheless requires high privileges (PR:H), matching the description's statement that the actor must already hold a shop_manager account. Impact is bounded: VC:L/VI:L with subsequent-system SC:L/SI:L reflects limited disclosure of internal responses rather than full compromise, consistent with an SSRF (CWE-918) that returns internal HTTP responses as import data. No EPSS score was supplied, and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a patch-available, privilege-gated, limited-impact SSRF. The main caveat is the trust model: shop_manager is an administrative WooCommerce role, so the barrier is a semi-trusted insider or a compromised/elevated account rather than an anonymous internet attacker - this materially lowers real-world urgency compared to an unauthenticated SSRF.

An attacker who holds (or has compromised) a WooCommerce shop_manager account uses the product import feature to submit a .csv URL on an attacker-controlled server. That server responds with an HTTP 302 redirect pointing at an internal address (e.g., a cloud metadata endpoint or an internal admin service), and the plugin's download_remote_file follows the redirect and returns the internal response back as import data, disclosing otherwise unreachable internal content. No public exploit identified at time of analysis.