CVE-2025-48123 — AI Deep Analysis Summary

🚨 **Essence**: A critical **Code Injection** flaw in the 'Spreadsheet Price Changer' plugin. 💥 **Consequences**: Attackers can inject malicious code, leading to full **Remote Code Execution (RCE)**.…

🛡️ **Root Cause**: **CWE-94** (Code Injection). The vulnerability stems from **improper code generation** within the plugin. It fails to sanitize or validate inputs correctly, allowing arbitrary PHP code execution.

🏢 **Affected Vendor**: Holest Engineering. 📦 **Product**: Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light. 📉 **Versions**: **2.4.37 and earlier** versions are vulnerable.…

💻 **Attacker Capabilities**: With **High Privileges**, hackers can execute arbitrary commands. 📂 **Data Impact**: They can read, modify, or delete sensitive site data.…

⚡ **Exploitation Threshold**: **LOW**. The CVSS vector shows **AV:N** (Network), **AC:L** (Low Complexity), **PR:N** (No Privileges Required), and **UI:N** (No User Interaction).…

🔍 **Public Exploit Status**: While specific PoC code isn't listed in the data, the references point to **Patchstack** databases confirming **RCE vulnerability**.…

🔎 **Self-Check Method**: 1. Log into your WordPress Admin. 2. Navigate to **Plugins**. 3. Find 'Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light'. 4. Check if the version is **≤ 2.4.37**. 5.…

🔧 **Official Fix**: Yes, the vendor (Holest Engineering) has acknowledged the issue via Patchstack.…

🚧 **No Patch Workaround**: If you cannot update immediately: 1. **Deactivate** the plugin entirely. 2. **Delete** it if not critical. 3.…

🔥 **Urgency**: **CRITICAL**. With **CVSS High** score and **No Auth** required, this is an immediate threat. 🚀 **Priority**: Patch **NOW**. Do not wait.…