Order Export & Order Import for WooCommerce <= 2.6.0 - Requisição Forjada do Lado do Servidor (SSRF) Autenticada (Administrador+) via Função validate_file

The SSRF vulnerability in Order Export & Order Import for WooCommerce allows an authenticated administrator to craft malicious requests that target internal services. An attacker could leverage this to query sensitive data, modify configurations, or even gain access to other internal systems that are not directly exposed to the internet. The potential blast radius extends to any internal service accessible from the WordPress server. While requiring administrator privileges, this vulnerability represents a significant risk, particularly in environments with shared hosting or where administrator accounts are poorly secured. Exploitation could lead to data breaches, system compromise, and disruption of business operations.

WordPress websites utilizing the Order Export & Order Import for WooCommerce plugin, particularly those with administrator accounts that have broad network access or are susceptible to credential compromise, are at risk. Shared hosting environments where multiple websites share the same server infrastructure are also at increased risk, as a successful exploitation on one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'validate_file(' /var/www/html/wp-content/plugins/order-export-order-import-for-woocommerce/*

• generic web:

curl -I <wordpress_site>/wp-content/plugins/order-export-order-import-for-woocommerce/validate_file.php | grep Server

1. 2025-03-20Disclosure

   disclosure

Instalações ativas

60KConhecido

Avaliação do plugin

4.7

Requer WordPress

3.0+

Compatível até

6.9.4

Requer PHP

5.6+

1. Reservado2025-03-04
2. Publicada2025-03-20
3. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-13923 is to upgrade the Order Export & Order Import for WooCommerce plugin to a patched version as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds such as restricting outbound network access from the WordPress server using a Web Application Firewall (WAF) or proxy server. Configure the WAF to block requests to internal IP addresses or known sensitive endpoints. Carefully review and restrict the plugin's access to internal resources. After upgrading, confirm the fix by attempting to trigger a request to an internal service through the plugin's functionality and verifying that the request is blocked or fails as expected.