CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Privilege Escalation.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
Explanation of Vulnerability in Simple Terms
A critical vulnerability in Spreadsheet Price Changer for WooCommerce and WP E-commerce allows unauthenticated attackers to read sensitive data, modify site content, and disrupt service without any user interaction. The plugin fails to properly restrict access to core functions, exposing the site to complete compromise. All versions up to 2.4.37 are affected.
What an attacker can do
Read sensitive data, modify site content, and disable the site without logging in or user interaction.
Potential impact on your site
Site data, pricing, and availability can be compromised by any remote attacker without warning or credentials.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
