CVE-2025-1912: Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validatefile() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1912?
CVE-2025-1912 is classified as a medium severity vulnerability due to its potential for exploitation via Server-Side Request Forgery.
How do I fix CVE-2025-1912?
To mitigate CVE-2025-1912, upgrade the Product Import Export for WooCommerce plugin to version 2.5.1 or later.
Who is affected by CVE-2025-1912?
Any WordPress site using the Product Import Export for WooCommerce plugin version 2.5.0 or lower is affected by CVE-2025-1912.
What kind of attack is possible due to CVE-2025-1912?
CVE-2025-1912 allows authenticated attackers to perform Server-Side Request Forgery attacks.
Is authentication required to exploit CVE-2025-1912?
Yes, exploitation of CVE-2025-1912 requires authentication as it targets authenticated admin users.