The Product Import Export for WooCommerce plugin contains a Server‑Side Request Forgery flaw in the validate_file() function. This flaw allows an authenticated user with Administrator‑level access to instruct the web application to make HTTP requests to arbitrary URLs from the server side. The attacker could thus query internal services, read sensitive data, or modify information stored in those services, compromising the confidentiality and integrity of those systems.

All versions of the Product Import Export for WooCommerce plugin released by webtoffee up to and including version 2.5.0 are affected. The vulnerability is present on WordPress installations that have this plugin active and administrators or higher‑privilege users enabled.

The CVSS score of 7.6 indicates a medium‑to‑high severity level. The EPSS score is less than 1%, suggesting that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. However, the requirement for administrator privileges means that if privileged accounts exist on the target, an attacker could abuse the SSRF vector to compromise internal resources. The main risk lies in the potential for internal data exposure and unauthorized manipulation of internal services.