Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light contains an incorrect privilege assignment flaw that can allow attackers to acquire higher rights than intended. The weakness aligns with CWE‑266 and can potentially enable an attacker to create or modify content with elevated privileges, leading to site compromise or unauthorized changes.

The vulnerability affects all releases of the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin up to and including version 2.4.37. Users running any of these versions within a WordPress installation are at risk.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is not explicitly described in the CVE data; it is inferred that exploitation would likely require a user with some level of site access to manipulate the plugin’s input handling, but the exact conditions are not specified.