A missing authorization check in the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin allows unauthenticated attackers to create WordPress administrator accounts, earning a CVSS score of 9.8.
What Is It
CVE-2025-10656 is a Missing Authorization vulnerability (CWE-862) in the user_filter function of the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress, published by vendor holest. The function does not verify the caller's authorization at all, and as a result unauthenticated attackers can use it to create admin accounts on the affected site.
The flaw carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low attack complexity, no privileges, and no user interaction required, with high impact to confidentiality, integrity, and availability.
Why It Matters
Administrator account creation is a full site takeover primitive. An attacker who obtains an admin account on a WordPress instance can install plugins, modify content, exfiltrate customer and order data from the WooCommerce store, and establish persistence. Because no authentication or user interaction is needed and the attack is remote, exploitation requires nothing more than reachability of the vulnerable endpoint.
This CVE was reported by Wordfence and was published to NVD on 2026-07-29. It is currently in "Received" status, meaning NVD analysis is not yet complete.
CVE-2025-10656 does not appear in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: holest
- Product: Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light (WordPress plugin)
- Affected versions: all versions up to and including 2.4.37
The NVD entry carries no CPE configuration data, consistent with its "Received" status.
Patch Status
The NVD entry for CVE-2025-10656 does not identify a fixed version, patch, or vendor advisory, and specifies no required remediation action. Defenders should treat any installation at or below 2.4.37 as vulnerable and consult the Wordfence advisory below for current remediation guidance.
Sources
- NVD, CVE-2025-10656: https://nvd.nist.gov/vuln/detail/CVE-2025-10656
- Wordfence Threat Intel advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/1f891b68-72c4-4f94-bd49-52576ad710f9?source=cve
- WordPress Plugin Trac,
sellingcommander.phpL3725: https://plugins.trac.wordpress.org/browser/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/trunk/sellingcommander.php#L3725