Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Code Injection Vulnerability Allowing Remote Code Execution

A code injection vulnerability has been identified in the Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin, affecting versions through 2.4.37. This vulnerability allows for remote code execution on the affected website.

Impact

Exploitation of this vulnerability allows for remote code execution on the target website, potentially leading to unauthorized access and control over the site.

Remediation

Users of the Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin are advised to update to a version later than 2.4.37. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate the vulnerability.