This vulnerability involves improper neutralization of special elements used in SQL commands within the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin by Holest Engineering. The issue affects all versions up to and including 2.4.37. It allows unauthenticated remote attackers to perform SQL Injection attacks, potentially compromising database confidentiality. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with high confidentiality impact but no integrity impact and low availability impact.

Successful exploitation could lead to unauthorized disclosure of sensitive database information due to SQL Injection. The vulnerability does not impact data integrity but may cause limited availability issues. Given the critical CVSS score of 9.3, the confidentiality impact is high, potentially exposing sensitive pricing or e-commerce data stored in the affected plugin's database tables.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.