EUVD-2025-17526
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3Tags
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light allows Path Traversal. This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light: from n/a through 2.4.37.
Analysis
A path traversal vulnerability (CWE-22) in Holest Engineering's Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light plugin allows unauthenticated remote attackers to read arbitrary files from the server by manipulating file path parameters. The vulnerability affects all versions through 2.4.37 and has a CVSS score of 7.5, indicating high confidentiality impact with no authentication required. Real-world exploitability depends on confirmation of active exploitation status and proof-of-concept availability; the low attack complexity and network accessibility suggest this is a genuine, easily-exploitable threat to affected WordPress installations.
Technical Context
This vulnerability exploits improper input validation in file handling operations within a WordPress plugin. The plugin processes user-supplied pathname parameters without adequate canonicalization or directory restriction checks, allowing attackers to use traversal sequences (e.g., '../../../etc/passwd') to escape intended directories and access files outside the plugin's designated scope. CWE-22 (Improper Limitation of Pathname to Restricted Directory) represents the root cause—the plugin fails to enforce boundaries on which filesystem locations users can access through its interface. The affected product is specifically the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin maintained by Holest Engineering. The vulnerability likely resides in file upload, import, or export functionality common to spreadsheet-handling WordPress plugins. WordPress plugins operate with web server privileges, making confidentiality breaches particularly concerning (e.g., access to wp-config.php, environment files, or other sensitive data).
Affected Products
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light (≤2.4.37)
Remediation
Upgrade to version 2.4.38 or later (specific patched version not yet disclosed in available data; check Holest Engineering's WordPress plugin repository or vendor advisory for confirmed patch release).; priority: IMMEDIATE Workaround: If patching is delayed, disable the plugin until an update is available. Alternatively, restrict HTTP access to the plugin's administrative interface using .htaccess rules or Web Application Firewall (WAF) policies to limit exploitation surface.; priority: HIGH Detection: Monitor server access logs and WAF logs for path traversal patterns targeting the plugin (e.g., requests containing '../', '..\', or encoded traversal sequences directed at plugin endpoints). Implement detection rules for suspicious file access attempts.; priority: IMMEDIATE Post-Incident: If the plugin is running on a compromised server, audit access logs for the vulnerability's exploitation window; examine exposed files (wp-config.php, environment files, database credentials) for unauthorized access; rotate credentials and perform a full security audit.; priority: CRITICAL (if exploited)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today