CVE-2025-10656: WooCommerce Plugin Missing Authorization Allows Unauthenticated Admin Account Creation

Executive Summary

A critical missing authorization vulnerability has been disclosed in the Spreadsheet Price Changer for WooCommerce and WP E-Commerce – Light WordPress plugin, tracked as CVE-2025-10656 with a CVSS score of 9.8 (Critical). The flaw exists in the user_filter function and affects all plugin versions up to and including 2.4.37. Unauthenticated attackers can exploit this vulnerability to create administrator-level accounts on affected WordPress installations, leading to full site compromise.

Vulnerability Details

Technical Analysis

The vulnerability exists within the user_filter function of the plugin, which lacks proper authorization checks before executing privileged operations. Because the function fails to verify whether the calling user has appropriate permissions, any unauthenticated HTTP request can invoke it to create a new WordPress administrator account.

Attack Vector

1. An unauthenticated attacker sends a crafted request to the vulnerable user_filter endpoint.
2. The plugin processes the request without verifying authentication or authorization.
3. A new administrator-level user is created on the target WordPress installation.
4. The attacker logs in with the newly created credentials, gaining full administrative control.

Impact

With administrative access, an attacker can:

• Install malicious plugins or themes containing backdoors
• Modify site content for phishing or malware distribution
• Exfiltrate customer data including payment information
• Establish persistent access via web shells
• Redirect site traffic to malicious domains

Affected Products

• Spreadsheet Price Changer for WooCommerce — all versions ≤ 2.4.37
• WP E-Commerce – Light — all versions ≤ 2.4.37

This plugin is used by WooCommerce store owners to bulk-edit product prices via spreadsheet import. The vulnerable function appears to be part of the user-management or filtering layer within the plugin's admin interface.

Remediation

Immediate Actions

1. Update the plugin to a patched version (2.4.38 or later) immediately.
2. Audit administrator accounts on all affected WordPress installations — look for newly created admin users you do not recognize.
3. Review site logs for suspicious requests targeting the user_filter endpoint.
4. Change all admin passwords and rotate API keys on affected sites.

Detection

Check your WordPress wp_users table for recently created accounts with admin privileges:

SELECT user_login, user_email, user_registered
FROM wp_users u
JOIN wp_usermeta m ON u.ID = m.user_id
WHERE m.meta_key = 'wp_capabilities'
  AND m.meta_value LIKE '%administrator%'
ORDER BY user_registered DESC;

Also inspect your web server logs for POST requests to plugin-related endpoints made by unauthenticated clients.

Mitigation (if patch unavailable)

• Deactivate and remove the plugin until a patch is available.
• Use a Web Application Firewall (WAF) to block unauthenticated POST requests to /wp-admin/admin-ajax.php or plugin-specific endpoints.
• Enable WordPress file integrity monitoring to detect unauthorized changes.

Risk Assessment

WordPress plugins with missing authorization vulnerabilities are among the most commonly exploited attack vectors against web properties. The combination of a CVSS 9.8 score, no authentication requirement, and the ability to create admin accounts makes CVE-2025-10656 particularly severe. WooCommerce-based stores should treat this as an emergency patch requiring immediate remediation.

References

• NVD Entry — CVE-2025-10656
• WordPress Plugin Directory — Spreadsheet Price Changer for WooCommerce
• OWASP — Broken Access Control