CVE-2025-48123: WooCommerce Price Changer RCE Vulnerability

CVE-2025-48123 Overview

CVE-2025-48123 is a critical Code Injection vulnerability affecting the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin developed by Holest Engineering. This vulnerability enables attackers to inject and execute arbitrary code on vulnerable WordPress installations, potentially leading to complete site compromise.

The vulnerability stems from improper control of code generation (CWE-94), where the plugin fails to adequately sanitize user-supplied input before processing it in a code execution context. This allows unauthenticated remote attackers to execute arbitrary code on the underlying server.

Critical Impact

This vulnerability allows unauthenticated remote code execution on WordPress sites running the affected plugin, potentially enabling complete server takeover, data theft, and lateral movement within the hosting environment.

Affected Products

• Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions up to and including 2.4.37
• WordPress installations with the vulnerable plugin activated
• WooCommerce and WP E-commerce stores utilizing the spreadsheet price management functionality

Discovery Timeline

• June 9, 2025 - CVE-2025-48123 published to NVD
• June 12, 2025 - Last updated in NVD database

Technical Details for CVE-2025-48123

Vulnerability Analysis

This Code Injection vulnerability exists in the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin. The flaw allows attackers to inject malicious code that gets executed by the server, bypassing normal security controls.

The vulnerability is particularly dangerous because it can be exploited remotely over the network without requiring any authentication or user interaction. Furthermore, the scope is changed, meaning a successful exploit can affect resources beyond the vulnerable component itself, potentially compromising the entire WordPress installation and underlying server infrastructure.

WordPress e-commerce sites are high-value targets due to the sensitive customer and payment data they typically handle. A successful exploitation could result in theft of customer personally identifiable information (PII), payment card data, modification of product prices, injection of malicious scripts affecting site visitors, or use of the compromised server as a pivot point for further attacks.

Root Cause

The root cause of CVE-2025-48123 is improper control of code generation (CWE-94). The plugin fails to properly validate and sanitize user-controlled input before it is used in dynamic code evaluation or generation contexts. This allows attackers to craft malicious payloads that, when processed by the plugin, result in arbitrary code execution on the server.

Specifically, the spreadsheet import or price modification functionality likely processes user-supplied data in an unsafe manner, allowing code injection through specially crafted input values.

Attack Vector

The attack vector for CVE-2025-48123 is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Identifying WordPress sites running the vulnerable Spreadsheet Price Changer plugin
2. Crafting a malicious request containing injected code within spreadsheet data or price modification parameters
3. Sending the request to the vulnerable endpoint
4. The injected code executes with the privileges of the web server process

The vulnerability can be exploited through the plugin's AJAX handlers or form processing endpoints that handle spreadsheet data imports or price modifications. For detailed technical information, refer to the Patchstack RCE Vulnerability Advisory.

Detection Methods for CVE-2025-48123

Indicators of Compromise

• Unexpected PHP files created in WordPress directories, particularly in wp-content/uploads/ or plugin directories
• Web server error logs showing unusual PHP evaluation errors or warnings
• Outbound network connections from the web server to unfamiliar IP addresses
• Modified WordPress core files or plugin files with injected code
• Unusual database queries or changes to WooCommerce product pricing data

Detection Strategies

• Monitor WordPress access logs for suspicious requests to Spreadsheet Price Changer plugin endpoints
• Implement file integrity monitoring to detect unauthorized changes to plugin files and WordPress core
• Deploy Web Application Firewall (WAF) rules to detect code injection patterns in HTTP requests
• Review PHP error logs for code execution anomalies related to the plugin's functionality

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and plugin activity
• Configure alerting for creation or modification of PHP files outside normal deployment processes
• Monitor for unusual process spawning from the web server process (e.g., www-data executing shell commands)
• Track failed and successful authentication attempts to WordPress admin interfaces

How to Mitigate CVE-2025-48123

Immediate Actions Required

• Immediately disable the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin until a patched version is available
• Review server logs for evidence of exploitation attempts against the affected plugin
• Conduct a thorough security audit of WordPress installations to identify any signs of compromise
• Implement WAF rules to block code injection attempts targeting WordPress plugin endpoints

Patch Information

Organizations should check the official WordPress plugin repository and Holest Engineering communications for an updated version that addresses this vulnerability. Until a patch is released, the plugin should remain deactivated on production sites.

For the latest vulnerability information and patch status, consult the Patchstack RCE Vulnerability Advisory.

Workarounds

• Deactivate and remove the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin from all WordPress installations
• Use alternative pricing management solutions that do not have known vulnerabilities
• Implement strict input validation at the WAF level for all requests to the WordPress installation
• Restrict access to WordPress admin and plugin endpoints using IP allowlisting where feasible

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate excel-like-price-change-for-woocommerce-and-wp-e-commerce-light --path=/var/www/html

# Verify plugin is deactivated
wp plugin list --path=/var/www/html | grep excel-like-price-change

# Check for suspicious files in uploads directory
find /var/www/html/wp-content/uploads -name "*.php" -type f -mtime -7