CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows SQL Injection.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
Explanation of Vulnerability in Simple Terms
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions 2.4.37 and earlier contain a SQL injection vulnerability in database queries. An unauthenticated attacker on the network can inject malicious SQL code to read sensitive data from the site's database, including customer information and pricing data. The vulnerability requires no user interaction and affects all installations running the affected versions.
What an attacker can do
Read sensitive data from the site's database, including customer records and pricing information.
Potential impact on your site
Customer data and pricing information stored in the database can be exposed to attackers without warning.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
