TI-2025-30494 Aliases CVE-2025-48124 GHSA-3j6f-38xg-724m

Path traversal in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP…

MEDIUM 40CWE-22Published 2025-06-09 · Updated 2026-04-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Path Traversal.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00564 47th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Holest Engineering	Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light	up to 2.4.37	—	No fix listed	CNA

Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light VendorHolest Engineering Affected up to 2.4.37 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-48124
2026-10-03 Alias added: GHSA-3j6f-38xg-724m

References

Other 1

https://patchstack.com/database/Wordpress/Plugin/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/vulnerability/wordpress-spreadsheet-price-changer-for-woocommerce-and-wp-e-commerce-light-2-4-37-arbitrary-file-download-vulnerability?_s_id=cve

TI-2025-30499 WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <=… CVSS 3.1CRITICAL 9.8
TI-2025-37609 WordPress Selling Commander for WooCommerce plugin <= 1.2.46 - Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
TI-2025-30493 Code injection in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP… CVSS 3.1CRITICAL 10.0
TI-2025-30492 SQL injection in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP… CVSS 3.1CRITICAL 9.3
TI-2025-26120 WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <=… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences