Threats tagged 'ghsa-j2r3-9f4h-g98h'

WebToffee Product Import Export for WooCommerce versions 2.5.1 up to but not including 2.6.8 contains a server-side request forgery (SSRF) vulnerability. This flaw exists in the download_remote_file function and allows users with shop_manager privileges to submit a CSV URL that triggers an HTTP 302 redirect to internal network addresses. The server then fetches internal responses and returns them as import data, potentially exposing internal services.