What is the CVSS score of CVE-2025-48124?

CVE-2025-48124 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-48124?

A path traversal vulnerability in the Spreadsheet Price Changer for WooCommerce and WP E-commerce plugin allows attackers to access restricted files on affected WordPress installations, potentially…

How to fix or mitigate CVE-2025-48124?

Within 24 hours: Identify all WordPress installations using Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin and document affected versions. Within 7 days: Disable or deactivate the vulnerable plugin on all production systems if business-critical functionality permits, or implement WAF rules to block path traversal attempts (e.g., requests containing '../' or encoded variants). Within 30 days: Monitor vendor communications for patch release and establish a patching timeline; if no patch emerges, evaluate alternative pricing management plugins and plan migration.

WordPress CVE-2025-48124

EUVD-2025-17526 HIGH

Path Traversal (CWE-22)

2025-06-09 audit@patchstack.com

WordPress Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17526

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light allows Path Traversal. This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light: from n/a through 2.4.37.

AnalysisAI

A path traversal vulnerability (CWE-22) in Holest Engineering's Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light plugin allows unauthenticated remote attackers to read arbitrary files from the server by manipulating file path parameters. The vulnerability affects all versions through 2.4.37 and has a CVSS score of 7.5, indicating high confidentiality impact with no authentication required. Real-world exploitability depends on confirmation of active exploitation status and proof-of-concept availability; the low attack complexity and network accessibility suggest this is a genuine, easily-exploitable threat to affected WordPress installations.

Technical ContextAI

This vulnerability exploits improper input validation in file handling operations within a WordPress plugin. The plugin processes user-supplied pathname parameters without adequate canonicalization or directory restriction checks, allowing attackers to use traversal sequences (e.g., '../../../etc/passwd') to escape intended directories and access files outside the plugin's designated scope. CWE-22 (Improper Limitation of Pathname to Restricted Directory) represents the root cause—the plugin fails to enforce boundaries on which filesystem locations users can access through its interface. The affected product is specifically the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin maintained by Holest Engineering. The vulnerability likely resides in file upload, import, or export functionality common to spreadsheet-handling WordPress plugins. WordPress plugins operate with web server privileges, making confidentiality breaches particularly concerning (e.g., access to wp-config.php, environment files, or other sensitive data).

RemediationAI

Upgrade to version 2.4.38 or later (specific patched version not yet disclosed in available data; check Holest Engineering's WordPress plugin repository or vendor advisory for confirmed patch release).; priority: IMMEDIATE Workaround: If patching is delayed, disable the plugin until an update is available. Alternatively, restrict HTTP access to the plugin's administrative interface using .htaccess rules or Web Application Firewall (WAF) policies to limit exploitation surface.; priority: HIGH Detection: Monitor server access logs and WAF logs for path traversal patterns targeting the plugin (e.g., requests containing '../', '..\', or encoded traversal sequences directed at plugin endpoints). Implement detection rules for suspicious file access attempts.; priority: IMMEDIATE Post-Incident: If the plugin is running on a compromised server, audit access logs for the vulnerability's exploitation window; examine exposed files (wp-config.php, environment files, database credentials) for unauthorized access; rotate credentials and perform a full security audit.; priority: CRITICAL (if exploited)