CVE-2025-48123
BaseFortify
Publication date: 2025-06-09
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-48123 is a Remote Code Execution (RCE) vulnerability in the WordPress plugin "Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light" up to version 2.4.37. It allows unauthenticated attackers to inject and execute arbitrary code on the affected website, potentially gaining full control over the site. This is due to improper control of code generation, classified under OWASP Top 10 category A3: Injection. [1]
How can this vulnerability impact me? :
This vulnerability can have a critical impact by allowing attackers to execute arbitrary commands remotely without authentication. This can lead to attackers gaining backdoor access, full control over the website, data theft, site defacement, or using the site as a platform for further attacks. Because of its high severity and ease of exploitation, it poses a significant risk to affected sites. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The provided resources do not include specific detection commands or methods to identify this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying Patchstack's virtual patch (vPatch), which blocks attacks exploiting this vulnerability until an official fix is released. Users should apply this mitigation promptly and seek professional incident response if their sites may have been compromised. Since no official patch is currently available, virtual patching is the fastest protection method. [1]