Medium severity · published May 27, 2026
CVE-2026-48971
WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Product Import Export for WooCommerce: from n/a through 2.5.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Product Import Export for WooCommerce · WebToffee
through 2.5.6 · source: vendor
Affected product
PI
Product Import Export for WooCommerce
WebToffee
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48971
patchstack.com
https://patchstack.com/database/wordpress/plugin/product-import-export-for-woo/vulnerability/wordpress-product-import-export-for-woocommerce-plugin-2-5-6-broken-access-control-vulnerability?_s_id=cve
More from Product Import Export for WooCommerce
7.6
CVE-2025-1912
Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
7.2
CVE-2025-1913
Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
7.2
CVE-2024-30231
WordPress Product Import Export for WooCommerce plugin <= 2.4.1 - Arbitrary File Upload vulnerability
7.2
CVE-2024-22152
WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File Upload
6.5
CVE-2025-1911
Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function