CVE-2024-22135 HIGH

CVE-2024-22135: WordPress Order Export & Order Import for WooCommerce Plugin <= 2.4.3 is vulnerable to Arbitrary File Upload

Vendor Webtoffee
Product Order Export & Order Import for WooCommerce
Weakness CWE-434 · Unrestricted file upload
Published January 24, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.0/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for WooCommerce: from n/a through 2.4.3.

Explanation of Vulnerability in Simple Terms

02Summary

The Order Export & Order Import for WooCommerce plugin allows authenticated administrators to upload files without proper validation. An attacker with admin access can upload malicious files to the server, potentially gaining control of the site. The vulnerability affects versions up to 2.4.3 and requires high-level privileges to exploit.

What an attacker can do

03Attacker Capabilities

Upload malicious files to the server and execute code on the site.

Potential impact on your site

04Site Impact

A compromised admin account can lead to full site takeover, data theft, or malware installation.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

January 24, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-6960 BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field CVE-2026-6518 CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code Execution CVE-2026-3459 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload CVE-2026-45444 WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerability CVE-2026-3533 JupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import