Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function

The SSRF vulnerability allows an authenticated administrator to craft malicious requests that originate from the WordPress application. This can be exploited to query internal services that are not directly accessible from the outside world, potentially exposing sensitive data or allowing attackers to interact with internal systems. For example, an attacker could attempt to access internal APIs, database management interfaces, or other administrative panels. The impact is amplified by the plugin's popularity and widespread use in e-commerce environments, potentially affecting a large number of online stores. Successful exploitation could lead to data breaches, unauthorized access to internal resources, and even complete compromise of the web server.

E-commerce businesses using WordPress and the Product Import Export for WooCommerce plugin are at risk. Specifically, sites running versions 1.0.0 through 2.5.0 are vulnerable. Shared hosting environments where plugin updates are managed by the hosting provider may be particularly susceptible if they haven't applied the update.

• wordpress / composer / npm:

grep -r 'validate_file()' /var/www/html/wp-content/plugins/product-import-export-for-woocommerce/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/product-import-export-for-woocommerce/ | grep Server

• wordpress / composer / npm:

wp plugin list | grep 'Product Import Export for WooCommerce'

• wordpress / composer / npm:

wp plugin update product-import-export-for-woocommerce

1. 2025-03-26Disclosure

   disclosure

アクティブインストール数

90K既知

プラグイン評価

4.6

WordPressが必要

3.0+

動作確認済みバージョン

6.9.4

PHPが必要

5.6+

1. 予約済み2025-03-03
2. 公開日2025-03-26
3. 更新日2026-04-08
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-1912 is to upgrade the Product Import Export for WooCommerce plugin to version 2.5.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the plugin's import/export functionality to trusted users only. Web Application Firewalls (WAFs) can be configured to block suspicious outbound requests originating from the plugin, specifically those targeting internal IP addresses or unusual domains. Monitor WordPress access logs for unusual outbound requests originating from the plugin’s files. After upgrading, confirm the fix by attempting to trigger the vulnerable function with a known malicious URL and verifying that the request is blocked or handled safely.