CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the user_filter function. This makes it possible for unauthenticated attackers to create admin accounts.
Explanation of Vulnerability in Simple Terms
The Spreadsheet Price Changer for WooCommerce and WP E-commerce plugin versions 2.4.37 and earlier contain an authorization flaw that allows unauthenticated attackers to read, modify, or delete sensitive data. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update immediately to a version newer than 2.4.37.
What an attacker can do
Read, modify, or delete product prices and other sensitive data without authentication.
Potential impact on your site
Attackers can alter product prices, delete pricing data, or expose customer information without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
