Vulnerability DatabaseCVE-2025-48129

CVE-2025-48129:
WordPress vulnerability analysis and mitigation

Overview

CVE-2025-48129 is an Incorrect Privilege Assignment vulnerability affecting Holest Engineering's Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin versions through 2.4.37. The vulnerability was discovered by researcher ch4r0n from FPT Software and was publicly disclosed on May 20, 2025 (Wiz Report, CVE Mitre).

Technical details

The vulnerability has been assigned a Critical CVSS score of 9.8, indicating its severe nature. It falls under the OWASP Top 10 category A7: Identification and Authentication Failures. The vulnerability allows for privilege escalation through unauthenticated access (Patchstack Database).

Impact

The vulnerability enables malicious actors to escalate their low-privileged account to higher privileges, potentially leading to full control of the website if high privileges are gained. Due to its critical nature, this vulnerability is expected to become mass exploited (Patchstack Database).

Mitigation and workarounds

As of the latest reports, no official fix is available for this vulnerability. However, Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available. Website administrators are advised to implement mitigation measures immediately (Patchstack Database).