The vulnerability is an improper control of filename in a PHP include/require statement within the Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin. Because user input can influence the filename, an attacker can provoke the plugin to read arbitrary files or execute code, a flaw classified as CWE‑98. The ability to read local files or run malicious code can lead to full compromise of the WordPress instance and any data stored on the server.

This issue affects the Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin, for all released versions up to and including 2.4.37. The plugin operates in WordPress installations that use WooCommerce or WP E-commerce, and no other vendors or products are listed as impacted.

The vulnerability has a CVSS score of 7.5, classified as high severity, though its EPSS score is below 1% indicating low current exploitation likelihood. It is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker sending crafted requests to the plugin’s file inclusion logic, possibly exploiting authenticated access or simply manipulating visitor input; success would allow reading sensitive local files or executing PHP code, potentially giving control over the web server.