An unauthenticated authorization bypass in the Spreadsheet Price Changer for WordPress plugin enables attackers to create administrative accounts and achieve full site takeover.

The plugin fails to perform adequate capability checks within the user_filter function. This oversight allows an unauthenticated attacker to invoke administrative functions and register new accounts with elevated privileges.

This vulnerability poses a critical threat to e-commerce platforms, as it allows unauthorized actors to gain full administrative control over the WordPress environment. The potential impacts include complete database compromise, theft of customer information, and site defacement, justifying the high CVSS score of 9.8.

Immediate Action: No patch is currently available; immediately deactivate and remove the plugin from the WordPress environment until a secure version is released.

Proactive Monitoring: Audit the user list for any unauthorized administrator accounts created recently and monitor server access logs for requests targeting the user_filter function.

Compensating Controls: Ensure that WordPress administrative interfaces are restricted by IP address or multi-factor authentication, and utilize a security plugin to monitor for unauthorized user account creation.

Public Exploit Available: No (unknown)

Given the severity of this unauthenticated privilege escalation vulnerability, immediate deactivation of the affected plugin is the only effective way to prevent compromise. Administrators should keep a close watch on vendor updates and remain vigilant for signs of unauthorized administrative activity.