Improper neutralization of special elements in an SQL command, identified as a classic SQL injection flaw in the Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin, allows an attacker to inject arbitrary SQL statements into database queries executed by the plugin. This can lead to read, modification, or deletion of data stored in the WordPress database, potentially compromising product pricing, order records, and customer information. The impact is therefore a database compromise that could undermine the integrity and confidentiality of the site’s data.

The affected product is the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin, released by Holest Engineering. Versions from the first available release through 2.4.37 are vulnerable. Any WordPress installation that has the plugin at those versions, regardless of the WordPress core version, is potentially exposed. No additional Affected Version details are specified beyond the <=2.4.37 cut‑off.

The CVSS score of 9.3 classifies this flaw as Critical. The EPSS score of <1% indicates a very low likelihood of exploitation, yet the severity remains high because the flaw provides an attack vector to alter database contents. The vulnerability is not listed in CISA’s KEV catalog. The available description does not state the required access level; based on typical plugin behavior, exploitation may require authenticated access to the plugin’s interface, but this is inferred and not explicitly confirmed by the source.