# Order Export & Order Import for WooCommerce

> The best order export import plugin for WooCommerce. Easily import and export WooCommerce orders and WooCommerce coupons using CSV.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 10:41 UTC.

## Facts (WordPress.org)

- Slug: `order-import-export-for-woocommerce`
- Author: WebToffee
- Version: 2.8.1
- Active installs: 50,000+
- Last update: 2026-11-11 (2 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 3.0, PHP 7.4
- Tags: advanced order export, coupon import export, woocommerce export orders, woocommerce import orders, woocommerce order import export
- Page: https://wordpress.org/plugins/order-import-export-for-woocommerce/

## Checks (against WordPress 7.1.4)

- OK: Updated 2 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Breaking ↔ Smooth, Slow ↔ Responsive, Paywalled ↔ Generous, Cluttered ↔ Clean, Locked in ↔ Portable, Behind ↔ Current.

## Known vulnerabilities

- 2026-10-10 MEDIUM: Unauthenticated Sensitive File Exposure  via Missing Directory Guard Re-verification in get_file_path() (up to 2.7.8). CVE-2026-94375, https://www.wordfence.com/threat-intel/vulnerabilities/id/726d0a00-b64b-4dfc-a498-d7decb6b5ebd?source=api-prod
- 2025-10-30 MEDIUM: Missing Authorization (up to 2.6.7). CVE-2025-64382, https://www.wordfence.com/threat-intel/vulnerabilities/id/164e9694-3cfd-4cac-8376-deabb1738abf?source=api-prod
- 2025-03-19 HIGH: Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function (up to 2.6.0). CVE-2024-13923, https://www.wordfence.com/threat-intel/vulnerabilities/id/3283b3ff-1787-466b-9517-84bd715e4165?source=api-prod
- 2025-03-19 LOW: Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function (up to 2.6.0). CVE-2024-13922, https://www.wordfence.com/threat-intel/vulnerabilities/id/4eb8f85f-656a-4e5a-a57d-7289da2cd951?source=api-prod
- 2025-03-19 HIGH: Authenticated (Admin+) PHP Object Injection via form_data Parameter (up to 2.6.0). CVE-2024-13921, https://www.wordfence.com/threat-intel/vulnerabilities/id/c5fcfa21-b3f7-4241-a931-9708ced4f811?source=api-prod
- 2025-03-19 MEDIUM: Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function (up to 2.6.0). CVE-2024-13920, https://www.wordfence.com/threat-intel/vulnerabilities/id/dba84eb3-f48a-4175-a652-7c11b12c9afc?source=api-prod
- 2024-05-14 HIGH: Authenticated (Administrator+) PHP Object Injection (up to 2.4.9). CVE-2024-34751, https://www.wordfence.com/threat-intel/vulnerabilities/id/726f5063-e904-4512-bbdc-305049219003?source=api-prod
- 2024-01-10 HIGH: Authenticated (Shop Manager+) Arbitrary File Upload via upload_import_file (up to 2.4.3). CVE-2024-22135, https://www.wordfence.com/threat-intel/vulnerabilities/id/15ce2e54-ca5a-4dbc-9795-6e989e85b330?source=api-prod
- 2020-03-11 HIGH: Arbitrary User Creation (before 1.6.1). WF-27ac48a7-52ee-46cb-a6d0-efbd2b516445-5, https://www.wordfence.com/threat-intel/vulnerabilities/id/27ac48a7-52ee-46cb-a6d0-efbd2b516445?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=order-import-export-for-woocommerce · HTML: https://todaywp.com/plugins/order-import-export-for-woocommerce