What is the CVSS score of CVE-2025-48122?

CVE-2025-48122 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-48122?

A critical SQL injection vulnerability (CVE-2025-48122, CVSS 9.3) exists in the Spreadsheet Price Changer plugin for WooCommerce and WP E-commerce affecting versions through 2.4.37.

How to fix or mitigate CVE-2025-48122?

Within 24 hours: Verify if the vulnerable plugin is installed and active; if yes, immediately disable or remove it and document all affected sites. Within 7 days: Implement WAF rules to block SQL injection patterns targeting the plugin, apply input validation controls at the application layer, and conduct database access logs review for suspicious activity. Within 30 days: Identify alternative pricing management solutions; contact vendor for patch ETA; perform security assessment of database access and user permissions; and develop incident response procedures for potential compromise.

WordPress CVE-2025-48122

EUVD-2025-17524 CRITICAL

SQL Injection (CWE-89)

2025-06-09 audit@patchstack.com

WordPress SQLi

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17524

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light allows SQL Injection. This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light: from n/a through 2.4.37.

AnalysisAI

A critical SQL injection vulnerability (CVE-2025-48122) exists in Holest Engineering's Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light plugin affecting versions through 2.4.37. An unauthenticated remote attacker can execute arbitrary SQL commands to extract sensitive database information including customer data and product details. The high CVSS score of 9.3 combined with network accessibility and no authentication requirement makes this a severe priority, particularly if the vulnerability is actively exploited or proof-of-concept code is publicly available.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) in a WordPress plugin that manages product pricing across WooCommerce and WP E-commerce platforms. The plugin processes user-supplied input through spreadsheet operations without proper parameterized query preparation or input sanitization before passing it to SQL database operations. This allows attackers to inject malicious SQL syntax into query parameters, bypassing intended logic. The affected product is a WordPress plugin (CPE likely: cpe:2.7:a:holest_engineering:spreadsheet_price_changer:*:*:*:*:*:wordpress:*:*), which runs in the context of WordPress's database abstraction layer but fails to use prepared statements or escaping functions like $wpdb->prepare(). The plugin processes spreadsheet data—potentially from file uploads or direct input fields—creating multiple injection vectors.

RemediationAI

action: Immediate Patching; details: Upgrade Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to version 2.4.38 or later. Check the WordPress plugin repository or Holest Engineering's website for patch availability. Use WordPress admin dashboard: Plugins → Updates, or manually download the patched version.
action: Temporary Deactivation; details: If a patched version is not yet available, immediately deactivate the plugin via WordPress admin dashboard until a patch is released. This eliminates the attack surface entirely.
action: Input Validation & Parameterized Queries; details: Plugin developers: Replace all direct SQL query construction with WordPress's $wpdb->prepare() function. Example: Use $wpdb->prepare('SELECT * FROM wp_posts WHERE ID = %d', $user_input) instead of concatenating variables into SQL strings.
action: Web Application Firewall (WAF); details: As a temporary mitigation, deploy WAF rules to detect and block SQL injection patterns (e.g., UNION, SELECT, DROP, EXEC keywords in unexpected parameters) targeting the plugin's endpoints.
action: Database Access Audit; details: After patching, audit recent database access logs and WordPress user activity for signs of exploitation or data exfiltration. Review customer data and payment records for unauthorized access.
action: Principle of Least Privilege; details: Ensure the WordPress database user running the plugin has minimal necessary privileges—read/write only to required tables, no DROP or ALTER permissions.