What is the CVSS score of EUVD-2025-210524?

EUVD-2025-210524 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Spreadsheet Price Changer are affected by EUVD-2025-210524?

The Spreadsheet Price Changer plugin for WooCommerce (all versions through 2.4.37) poses an immediate critical risk to WordPress sites: any internet visitor can remotely gain complete administrative…

How to fix or mitigate EUVD-2025-210524?

Within 24 hours: audit all WordPress installations for the Spreadsheet Price Changer plugin and disable it via the WordPress admin panel; search server logs for requests containing 'user_filter' parameters to identify potential exploitation. Within 7 days: permanently remove all plugin files from the filesystem, verify the WordPress user database contains no unauthorized administrator accounts, and implement an alternative pricing solution from your security-vetted plugin list. Within 30 days: perform full database audit for unauthorized modifications, implement plugin change-detection and user-creation alerting, and enforce security code review for all plugin additions.

Spreadsheet Price Changer EUVD-2025-210524

| CVE-2025-10656 CRITICAL

Incorrect Authorization (CWE-863)

2026-07-29 Wordfence

GHSA-p226-wwrr-fmww

WordPress Authentication Bypass Wordpress Plugin Spreadsheet Price Changer For Woocommerce And Wp E Commerce Light Holest

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote request (AV:N/PR:N/UI:N/AC:L) creates an admin account, granting full control, so C/I/A are all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 09:53 vuln.today

CVE Published

Jul 29, 2026 - 08:32 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the user_filter function. This makes it possible for unauthenticated attackers to create admin accounts.

Articles & Coverage 1

News Critical Privilege Escalation in WordPress Spreadsheet Price Changer Plugin - CVE-2025-10656 Jul 30, 2026

AnalysisAI

Privilege escalation to administrator in the Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light WordPress plugin (all versions through 2.4.37) lets unauthenticated attackers create new admin accounts through the unprotected user_filter function. Because no capability or nonce check gates the routine, any remote visitor can seize full control of the WordPress site, making this a critical site-takeover flaw; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress e-commerce utility plugin (vendor 'holest') that bulk-edits product prices for WooCommerce and WP E-commerce stores by importing spreadsheet data. The vulnerability is classified as CWE-863 (Incorrect Authorization): the user_filter function - visible in the plugin source at sellingcommander.php around line 3725 - performs a sensitive action (user creation) without verifying the caller's identity or capabilities. In WordPress, such functions are typically hooked to AJAX or admin actions and must gate access with current_user_can() and nonce validation; their absence here means the code path executes for anyone who can reach it, including unauthenticated requests.

RemediationAI

No fixed version was provided in the input, so treat the primary remediation as upgrading to a patched release above 2.4.37 once the vendor publishes one - monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/1f891b68-72c4-4f94-bd49-52576ad710f9?source=cve) and the plugin's WordPress.org page for a patched version; no vendor-released patch is independently confirmed at time of analysis. As an immediate compensating control, deactivate and remove the Spreadsheet Price Changer plugin until a fix ships, since the unauthenticated user-creation path cannot otherwise be reliably closed (trade-off: loss of bulk price-editing functionality). If removal is not possible, restrict access to the plugin's AJAX/admin endpoints via a WAF rule or web-server ACL blocking the user_filter action, and audit wp_users for unexpected administrator accounts, revoking any that were created without authorization (trade-off: WAF signatures may be bypassable and require tuning to avoid blocking legitimate store operations).