CVE-2025-10656

CriticalCVSS 9.8

Published: 29/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

40th percentile - higher than 40% of all known CVEs

Summary

Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress up to 2.4.37 lacks authorization in the user_filter function, allowing unauthenticated attackers to create admin accounts.

Risk Assessment

An attacker can gain full control of the WordPress site by creating an admin account.

Recommendation

Immediately update the plugin to version 2.4.38 or later if available.

Original NVD description (English source)

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the user_filter function. This makes it possible for unauthenticated attackers to create admin accounts.