This vulnerability involves improper neutralization of special elements used in SQL commands within the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin by Holest Engineering. Versions up to and including 2.4.37 are affected. The flaw allows remote attackers to perform SQL Injection attacks without authentication or user interaction, potentially leading to high confidentiality impact and partial availability impact. The CVSS vector indicates the attack can be performed over the network with low attack complexity and no privileges required. No vendor advisory or patch information is currently available.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the affected system's database. This could lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). Integrity impact is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin's interfaces and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the affected plugin to untrusted networks. Do not rely on generic mitigations unless specifically recommended by the vendor.