CVE-2025-39378: WooCommerce Spreadsheet Price Changer LFI

CVE-2025-39378 Overview

CVE-2025-39378 is a Local File Inclusion (LFI) vulnerability in the Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light WordPress plugin (excel-like-price-change-for-woocommerce-and-wp-e-commerce-light). The flaw stems from improper control of filenames passed to PHP include or require statements, classified under [CWE-98]. All plugin versions up to and including 2.4.37 are affected. Successful exploitation lets an attacker load arbitrary local PHP files on the server, potentially leading to code execution, credential theft, or full site compromise.

Critical Impact
Attackers can include arbitrary local PHP files through the vulnerable plugin, exposing sensitive configuration data and enabling code execution on affected WordPress sites.

Affected Products

Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light, versions up to and including 2.4.37
WordPress installations running the excel-like-price-change-for-woocommerce-and-wp-e-commerce-light plugin
WooCommerce and WP E-commerce stores using this plugin for bulk price management

Discovery Timeline

2025-04-24 - CVE-2025-39378 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-39378

Vulnerability Analysis

The vulnerability resides in plugin code that constructs filesystem paths using attacker-controlled input and passes the result to a PHP file inclusion function such as include, include_once, require, or require_once. Because the input is not normalized or restricted to an allowlist, an attacker can supply path traversal sequences or alternate filenames that resolve to files outside the intended template directory.

When PHP includes a file, the engine executes any PHP code contained within. As a result, an LFI flaw on a WordPress server is not limited to information disclosure. If the attacker can write controlled content to a file the web server can read (uploads, log files, session storage), the inclusion can be escalated to remote code execution.

Exploitation requires user interaction, which typically means luring an authenticated administrator or privileged user into clicking a crafted link triggering the vulnerable request handler.

Root Cause

The root cause is improper validation and sanitization of filename input used in PHP include/require statements. The plugin does not enforce an allowlist of permitted template files and does not strip directory traversal characters such as ../ before constructing the include path.

Attack Vector

The attack vector is network-based. An attacker crafts a URL targeting the vulnerable plugin endpoint with a manipulated file parameter. After a privileged user follows the link, the plugin loads the attacker-specified file from the local filesystem. Common targets include wp-config.php for credential disclosure and writable upload paths for code execution.

For technical specifics, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-39378

Indicators of Compromise

HTTP requests to plugin endpoints under /wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/ containing path traversal sequences such as ../ or encoded variants %2e%2e%2f.
Web server access logs showing parameter values referencing sensitive paths like wp-config.php, /etc/passwd, or PHP session files.
Unexpected PHP errors referencing include() or require() with paths outside the plugin directory.

Detection Strategies

Inspect WordPress and web server logs for requests to the vulnerable plugin combined with file-related query parameters.
Deploy a Web Application Firewall rule that blocks path traversal patterns and null byte sequences in plugin parameters.
Run a plugin inventory scan to identify WordPress sites running version 2.4.37 or earlier of the affected plugin.

Monitoring Recommendations

Monitor for outbound connections from the PHP-FPM or web server process that deviate from baseline behavior, indicating post-inclusion code execution.
Alert on file integrity changes within wp-content/uploads/ and PHP session directories that could be used as inclusion targets.
Enable verbose logging on plugin endpoints and forward to a SIEM such as Singularity Data Lake for correlation across the WordPress fleet.

How to Mitigate CVE-2025-39378

Immediate Actions Required

Update the Spreadsheet Price Changer plugin to a version newer than 2.4.37 once the vendor publishes a fix.
Disable or remove the plugin if a patched version is not yet available and the functionality is not business-critical.
Restrict administrative access to trusted networks to reduce exposure to user-interaction-based exploitation.

Patch Information

At the time of NVD publication, the advisory lists affected versions as n/a through <= 2.4.37. Administrators should consult the Patchstack Vulnerability Report and the WordPress.org plugin page for the latest patched release and apply it without delay.

Workarounds

Configure a Web Application Firewall to block requests containing ../, encoded traversal sequences, and absolute filesystem paths in plugin parameters.
Set the PHP open_basedir directive to limit file access to the WordPress installation directory, reducing the impact of inclusion attacks.
Train administrators to avoid clicking unsolicited links to the WordPress admin interface, since exploitation requires user interaction.

bash

# Example php.ini hardening to limit file inclusion scope
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off