The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin suffers from an incorrect authorization vulnerability (CWE-863) in the user_filter function. This flaw allows unauthenticated attackers to bypass authorization controls and create administrative accounts. The issue affects all versions up to and including 2.4.37. No official patch or remediation has been disclosed by the vendor as of the publication date. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation enables unauthenticated attackers to create admin accounts, granting them full administrative control over the affected WordPress site. This can lead to complete compromise of the site, including data theft, site defacement, or further malicious activity. The vulnerability severely impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and consider disabling or removing it to prevent exploitation. Monitor for updates from the vendor or trusted security sources for a patch or official mitigation.