CVE-2025-10656: WordPress Plugin Auth Bypass Vulnerability

CVE-2025-10656 Overview

CVE-2025-10656 is a missing authorization vulnerability in the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress. The flaw affects all versions up to and including 2.4.37. The vulnerable user_filter function fails to enforce capability checks, allowing unauthenticated attackers to create administrator accounts on affected sites. Successful exploitation grants complete control of the WordPress installation, including content, users, and installed plugins. The issue is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Unauthenticated attackers can create WordPress administrator accounts remotely over the network, resulting in full site takeover.

Affected Products

Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress
All plugin versions up to and including 2.4.37
WordPress sites running WooCommerce or WP E-commerce with the vulnerable plugin installed

Discovery Timeline

2026-07-29 - CVE-2025-10656 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-10656

Vulnerability Analysis

The vulnerability resides in the user_filter function within sellingcommander.php of the plugin source. The function is exposed through an AJAX endpoint but lacks both a capability check and a nonce verification. Any unauthenticated visitor can invoke the endpoint and pass parameters that create a new WordPress user with the administrator role. Once a new administrator account exists, the attacker can log in, upload arbitrary plugins or themes, execute PHP code, and pivot to the underlying host. The condition is a textbook broken access control failure in server-side privileged operations.

Root Cause

The root cause is missing authorization on a state-changing action. The plugin registers the user_filter handler for AJAX access without gating execution behind current_user_can() or a WordPress nonce. Because WordPress permits wp-admin/admin-ajax.php calls from anonymous clients when actions are registered on the nopriv hook, the function processes attacker-controlled input as if it originated from a trusted administrator. See the WordPress plugin code review for the vulnerable code path.

Attack Vector

Exploitation requires only network access to the target site. An attacker sends an HTTP POST request to admin-ajax.php referencing the vulnerable action and supplies user parameters such as user_login, user_email, user_pass, and role=administrator. The plugin creates the account without validating the caller's identity or privileges. No user interaction, credentials, or prior foothold are required. Refer to the Wordfence vulnerability report for additional exploitation context.

Detection Methods for CVE-2025-10656

Indicators of Compromise

Unexpected WordPress user accounts with the administrator role appearing in wp_users and wp_usermeta tables.
HTTP POST requests to /wp-admin/admin-ajax.php referencing the user_filter action from unauthenticated sources.
New plugin, theme, or file uploads shortly after suspicious account creation events.
Outbound connections from the web server to attacker-controlled infrastructure following administrator account creation.

Detection Strategies

Audit the WordPress user list and compare against approved administrators; flag any account created after the plugin was installed.
Enable and review admin-ajax.php access logs for anonymous requests targeting plugin-specific actions.
Deploy web application firewall rules that block unauthenticated calls to the user_filter action while a patch is unavailable.

Monitoring Recommendations

Alert on WordPress user_register events that occur outside of expected administrative workflows.
Monitor file integrity for changes to wp-content/plugins/, wp-content/themes/, and wp-config.php.
Correlate new administrator logins with source IP reputation and geolocation to identify unauthorized access.

How to Mitigate CVE-2025-10656

Immediate Actions Required

Deactivate and remove the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin until a fixed version is released.
Review all WordPress administrator accounts and delete any that are not explicitly authorized.
Rotate credentials for remaining administrator accounts and enforce multi-factor authentication.
Restore the site from a known-good backup if unauthorized account creation is confirmed.

Patch Information

At the time of publication, no fixed version beyond 2.4.37 is referenced in the available advisories. Monitor the Wordfence vulnerability report and the plugin's WordPress.org listing for a patched release, and update immediately once available.

Workarounds

Block the vulnerable AJAX action at the web application firewall or reverse proxy layer.
Restrict access to /wp-admin/admin-ajax.php to authenticated sessions where feasible.
Remove the plugin directory from disk if immediate deactivation through the admin interface is not possible.

bash

# Example nginx rule to block unauthenticated requests to the vulnerable action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "user_filter") {
        return 403;
    }
}