WebToffee Export and Import Users and Customers

• CVE-2026-104368 High 8.8 Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field 0.3%
• CVE-2025-1973 Medium 4.9 Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function 0.7%
• CVE-2025-1970 High 7.6 Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function 0.4%
• CVE-2025-1971 High 7.2 Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter 0.8%
• CVE-2025-1972 Low 2.7 Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function 0.4%
• CVE-2023-6558 High 7.2 Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload 1.4%
• CVE-2023-3459 High 7.2 Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change 0.9%