Attack Chain

1. An unauthenticated attacker identifies a WordPress site running the vulnerable Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light plugin.
2. The attacker crafts a malicious HTTP request targeting the user_filter function within the sellingcommander.php file of the plugin.
3. This request leverages the Missing Authorization vulnerability (CVE-2025-10656) by including parameters designed to register a new user with elevated privileges.
4. Due to the lack of proper authentication checks, the plugin processes the attacker's request as legitimate.
5. The vulnerable plugin creates a new administrator account on the WordPress site as specified by the attacker.
6. The attacker uses the credentials of the newly created administrator account to log into the WordPress dashboard.
7. With administrative access, the attacker gains full control over the compromised WordPress site.

Impact

The successful exploitation of CVE-2025-10656 results in a complete compromise of the affected WordPress site. Attackers gain full administrative control, which can lead to severe consequences including, but not limited to, website defacement, arbitrary code execution (via malicious plugin/theme uploads), data theft, deployment of web shells, or redirection of legitimate users to malicious sites. This vulnerability poses a significant risk to the integrity and availability of the targeted web application and associated data, potentially affecting customers and business operations.

Recommendation

• Immediately update the "Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light" plugin to a patched version beyond 2.4.37, or disable and remove the plugin if an update is not available.
• Review web server access logs for any suspicious HTTP requests targeting sellingcommander.php or the user_filter function, especially those originating from unusual IP addresses or user agents.
• Monitor WordPress user logs for the creation of new administrator accounts that were not legitimately authorized.