The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and i…

CVE-2025-10656 affects the Spreadsheet Price Changer for WooCommerce and WP E-commerce Light plugin for WordPress in all versions up to and including 2.4.37. The vulnerability exists in the user_filter function due to missing authorization checks. Unauthenticated attackers can exploit this flaw to create administrator accounts on affected WordPress sites. This represents a critical privilege escalation risk as it grants full administrative control to unauthorized parties. No authentication is required to exploit the vulnerability, making it accessible to any remote attacker. Site owners using the affected plugin versions should update immediately or apply mitigations. The vulnerability was reported via NVD and corroborated by Wordfence threat intelligence.