Improper control over code generation in the Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin creates a code injection vulnerability (CWE‑94). An attacker who can influence the plugin’s input can execute arbitrary PHP code on the host, potentially compromising the entire WordPress installation. The plugin allows code injection through its Excel‑like price‑change interface, giving the attacker full control over the site’s server side functionality.

The vulnerable product is Holest Engineering’s Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light, in all releases from the initial version up to and including 2.4.37. Sites running any of these versions with WordPress, WooCommerce or WP E-commerce are at risk.

The CVSS score of 10 indicates critical severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker manipulating the plugin’s price‑change spreadsheet upload or input to inject malicious PHP code, which is then executed in the context of the WordPress site. Immediate action is required to prevent potential full system compromise.