EUVD-2025-17524CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3DescriptionNVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light allows SQL Injection. This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light: from n/a through 2.4.37.
AnalysisAI
A critical SQL injection vulnerability (CVE-2025-48122) exists in Holest Engineering's Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light plugin affecting versions through 2.4.37. An unauthenticated remote attacker can execute arbitrary SQL commands to extract sensitive database information including customer data and product details. The high CVSS score of 9.3 combined with network accessibility and no authentication requirement makes this a severe priority, particularly if the vulnerability is actively exploited or proof-of-concept code is publicly available.
Technical ContextAI
The vulnerability is a classic SQL injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) in a WordPress plugin that manages product pricing across WooCommerce and WP E-commerce platforms. The plugin processes user-supplied input through spreadsheet operations without proper parameterized query preparation or input sanitization before passing it to SQL database operations. This allows attackers to inject malicious SQL syntax into query parameters, bypassing intended logic. The affected product is a WordPress plugin (CPE likely: cpe:2.7:a:holest_engineering:spreadsheet_price_changer:*:*:*:*:*:wordpress:*:*), which runs in the context of WordPress's database abstraction layer but fails to use prepared statements or escaping functions like $wpdb->prepare(). The plugin processes spreadsheet data—potentially from file uploads or direct input fields—creating multiple injection vectors.
RemediationAI
- action: Immediate Patching; details: Upgrade Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to version 2.4.38 or later. Check the WordPress plugin repository or Holest Engineering's website for patch availability. Use WordPress admin dashboard: Plugins → Updates, or manually download the patched version.
- action: Temporary Deactivation; details: If a patched version is not yet available, immediately deactivate the plugin via WordPress admin dashboard until a patch is released. This eliminates the attack surface entirely.
- action: Input Validation & Parameterized Queries; details: Plugin developers: Replace all direct SQL query construction with WordPress's $wpdb->prepare() function. Example: Use $wpdb->prepare('SELECT * FROM wp_posts WHERE ID = %d', $user_input) instead of concatenating variables into SQL strings.
- action: Web Application Firewall (WAF); details: As a temporary mitigation, deploy WAF rules to detect and block SQL injection patterns (e.g., UNION, SELECT, DROP, EXEC keywords in unexpected parameters) targeting the plugin's endpoints.
- action: Database Access Audit; details: After patching, audit recent database access logs and WordPress user activity for signs of exploitation or data exfiltration. Review customer data and payment records for unauthorized access.
- action: Principle of Least Privilege; details: Ensure the WordPress database user running the plugin has minimal necessary privileges—read/write only to required tables, no DROP or ALTER permissions.
Share
External POC / Exploit Code
Leaving vuln.today