CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows PHP Local File Inclusion.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
Explanation of Vulnerability in Simple Terms
A vulnerability in Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions 2.4.37 and earlier allows an attacker to read sensitive data, modify site content, or disrupt service. The attack requires the victim to visit a malicious link or page. No authentication is needed. The vulnerability stems from improper input handling in the plugin.
What an attacker can do
Read sensitive data, modify site content, or disrupt the site's availability.
Potential impact on your site
Site data and content could be compromised; users may experience service interruption.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
