Webtoffee
Vulnerability activity for Webtoffee: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 5
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 6
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 6
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.7MediumNov 7, 2026WebToffee WP Backup and Migration SQL injectionCVE-2026-120530The WebToffee WP Backup and Migration plugin for WordPress is vulnerable to generic SQL Injection via the 'description' parameter in all versions up to, and including, 1.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information
- 8.8HighOct 30, 2026Webtoffee Export and Import Users and Customers Privilege escalationCVE-2026-104368The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the es
- 5.5MediumOct 29, 2026WebToffee Product Import Export for WooCommerce SSRFCVE-2026-118989WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
- 7.5HighOct 10, 2026WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels Auth bypass / access controlCVE-2026-93746The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret
- 5.3MediumOct 10, 2026Webtoffee Order Export & Order Import for WooCommerce Path traversal / file handlingCVE-2026-94375The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing customer PII — including names, billing and shipping addresses, email addresses, phone numbers, and order contents — directly over HTTP with no authentication. This is exploitable whenever the .htaccess and
- 7.5HighSep 30, 2026WebToffee WordPress Backup & Migration Auth bypass / access controlCVE-2026-97197Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
Top products
- WordPress Backup & Migration1 CVE in the last year
- WebToffee WP Backup and Migration1 CVE in the last year
- WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels1 CVE in the last year
- Product Import Export for WooCommerce1 CVE in the last year
- Order Export & Order Import for WooCommerce1 CVE in the last year
- Export and Import Users and Customers1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.