Comments Import Export CVE-2026-32441

Authenticated user with any WordPress login role accessing WebToffee Comments Import & Export plugin versions ≤2.4.9. Attacker exploits missing authorization checks to cause denial of service through resource exhaustion. Default configurations affected; no special plugin settings required.

While CVSS score and vector data are unavailable, the vulnerability presents a credible real-world risk based on multiple corroborating signals. The CWE-862 classification (Missing Authorization) is consistently high-impact in WordPress environments, particularly for plugins handling sensitive data like comments. The affected product is a WooCommerce plugin, targeting e-commerce sites where comment data may include customer reviews and potentially sensitive information. Patchstack's reporting indicates this is a known vulnerability with documented impact. The absence of CVSS data and EPSS scores limits quantitative risk modeling, but the presence of confirmed affected versions (through 2.4.9) and Patchstack's triage suggests active researcher interest. For WordPress administrators, this should be treated as a priority remediation item given that missing authorization vulnerabilities in comment handling can lead to data manipulation, spam injection, or competitive review tampering in e-commerce contexts. The lack of publicly detailed POC information is a moderate mitigating factor, but the vulnerability class is well-understood and relatively straightforward to exploit once discovered.

An attacker with a subscriber or lower-privilege WordPress account (or an unauthenticated actor if the plugin's endpoints are fully unprotected) could directly call the plugin's import/export functions via AJAX or REST API without proper authorization checks. The attacker could craft requests to import malicious comments into product reviews, export sensitive comment data for harvesting, or modify existing comments to inject spam or promotional content. Given the missing authorization flaw (CWE-862), no complex exploitation technique is required—simply sending an HTTP request to the vulnerable endpoint with comment data would likely succeed, making this a low-complexity attack with high convenience for malicious actors targeting WooCommerce sites.