This vulnerability arises from improper validation or control of filenames used in PHP include or require statements within the Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin. The flaw allows an attacker to perform PHP Local File Inclusion, potentially enabling unauthorized access to sensitive files or code execution. It affects all versions up to 2.4.37. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to disclosure of sensitive information, modification of data, or disruption of service due to the Local File Inclusion vulnerability. The high CVSS score reflects the potential for significant impact on affected systems. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from Holest Engineering. Until a fix is available, consider restricting access to the plugin and limiting user interactions that could trigger the vulnerability.