CVE-2026-48971: WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability
Published May 27, 2026
·Updated
Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Product Import Export for WooCommerce: from n/a through 2.5.6.
Affected Software
1 affected component
WebToffee Product Import Export for WooCommerce<=2.5.6
Remediation
Information
Update the WordPress Product Import Export for WooCommerce Plugin to the latest available version (at least 2.5.7).
Event History
May 27, 2026
CVE Published
via MITRE·11:53 AM
Data Sourced
via MITRE·11:53 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-48971?
The severity of CVE-2026-48971 is medium, with a CVSS score of 4.3.
2
How do I fix CVE-2026-48971?
You can fix CVE-2026-48971 by updating the WebToffee Product Import Export for WooCommerce plugin to at least version 2.5.7.
3
What type of vulnerability is CVE-2026-48971?
CVE-2026-48971 is categorized as a Broken Access Control vulnerability.
4
Which versions of the WebToffee Product Import Export for WooCommerce plugin are affected by CVE-2026-48971?
CVE-2026-48971 affects WebToffee Product Import Export for WooCommerce from version n/a through 2.5.6.
5
What impact does CVE-2026-48971 have?
CVE-2026-48971 can lead to unauthorized access due to incorrectly configured access control security levels.