The vulnerability CVE-2025-48124 involves improper limitation of a pathname to a restricted directory (path traversal) in the Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin by Holest Engineering. This flaw allows an attacker to manipulate file paths to access files outside the intended directory scope, potentially exposing sensitive data. The issue affects all versions up to and including 2.4.37. The CVSS 3.1 base score is 7.5, reflecting a high-severity vulnerability exploitable remotely without authentication or user interaction. No patch or official remediation guidance is currently provided.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to read arbitrary files on the affected system outside the restricted directory. This could lead to disclosure of sensitive information. The vulnerability does not impact integrity or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting access to the plugin and limiting exposure of the affected system to untrusted networks. Monitor official Holest Engineering channels for updates and apply any official fixes promptly once released.