PT-2026-65739 · Holest · Spreadsheet Price Changer For Woocommerce/Wp E-Commerce – Light

Kr0D · CVE-2025-10656 · Published 2026-07-29 · Updated 2026-07-29

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the user filter function. This makes it possible for unauthenticated attackers to create admin accounts.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-10656

Affected Products

Spreadsheet Price Changer For Woocommerce/Wp E-Commerce – Light

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-10656 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1f891b68-72c4-4f94-bd49-52576ad710f9?source=cve · Note
• https://plugins.trac.wordpress.org/browser/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/trunk/sellingcommander.php#L3725 · Note