The vulnerability identified as CVE-2025-48123 affects the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin by Holest Engineering. It is an improper control of code generation vulnerability, commonly known as code injection, which allows remote attackers to execute arbitrary code on affected installations. The issue impacts all versions up to 2.4.37. The CVSS 3.1 base score of 10.0 reflects the critical nature of this vulnerability, with network attack vector, no required privileges or user interaction, and complete compromise of confidentiality, integrity, and availability. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could lead to full system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of service. Given the critical CVSS score and the nature of code injection, attackers could execute arbitrary code remotely without authentication or user interaction, severely impacting affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.