CVE-2026-118989 | WebToffee Product Import Export Plugin up to 2.6.7 Download Remote File download_remote_file server-side request forgery

October 29, 2026 Yanac

A vulnerability labeled as critical has been found in WebToffee Product Import Export Plugin up to 2.6.7. This vulnerability affects the function download_remote_file of the component Download Remote File. Such manipulation leads to server-side request forgery.

This vulnerability is traded as CVE-2026-118989. The attack may be launched remotely. There is no exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More