What is the CVSS score of CVE-2025-49924?

CVE-2025-49924 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wholesale Suite are affected by CVE-2025-49924?

The WooCommerce Wholesale Suite plugin (woocommerce-wholesale-prices, versions ≤2.2.4.2) contains a privilege escalation vulnerability affecting WordPress-based e-commerce sites, allowing…

How to fix or mitigate CVE-2025-49924?

Within 24 hours, conduct inventory scan to identify all WordPress installations running woocommerce-wholesale-prices plugin version 2.2.4.2 or earlier, and document the business criticality of the wholesale functionality. Within 7 days, implement least-privilege access controls by restricting administrative account access to users with genuine need, enable detailed audit logging for all administrative activities, and consider deactivating the plugin if redundant or non-critical to business operations. Within 30 days, monitor the plugin vendor's advisory channels daily for a security patch release, evaluate alternative wholesale pricing solutions that support your requirements, and conduct access review to ensure unnecessary admin privileges have been revoked.

Wholesale Suite CVE-2025-49924

HIGH

Incorrect Privilege Assignment (CWE-266)

2025-10-22 audit@patchstack.com

WordPress Privilege Escalation

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable plugin action needs an existing high-privilege account (PR:H), no user interaction, and full escalation yields complete CIA impact within the unchanged WordPress scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:20 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 7.2

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through <= 2.2.4.2.

AnalysisAI

Privilege escalation in the WooCommerce Wholesale Suite (woocommerce-wholesale-prices) plugin for WordPress through version 2.2.4.2 allows an already-authenticated user to gain privileges beyond what they were assigned. Rated CVSS 7.2 (high) with a network vector but requiring high privileges, the flaw stems from incorrect privilege assignment (CWE-266) and can lead to full compromise of the affected store's confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.05%, 16th percentile), indicating limited near-term mass-exploitation likelihood.

Technical ContextAI

Wholesale Suite is a commercial WordPress/WooCommerce extension (plugin slug woocommerce-wholesale-prices) that adds B2B wholesale pricing, roles, and ordering to WooCommerce stores. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), a class of flaw where the application grants an entity permissions it should not have - here, mapping a lower-privileged account or role to capabilities reserved for higher-privileged users. In WordPress plugins this commonly manifests through custom role/capability handling, insufficient capability checks on privileged AJAX or admin actions, or logic that assigns WooCommerce/WordPress capabilities incorrectly. No CPE strings were provided in the intelligence, so the affected component is identified only by the plugin slug and vendor advisory rather than formal NVD CPE data.

Affected ProductsAI

The affected product is Josh Kohlbach's Wholesale Suite plugin for WordPress/WooCommerce (plugin slug woocommerce-wholesale-prices). Impacted versions span from an unspecified lower bound (n/a) through and including 2.2.4.2. No CPE identifiers were supplied in the intelligence. The vendor/coordinator advisory is published by Patchstack at https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-prices/vulnerability/wordpress-wholesale-suite-plugin-2-2-4-2-privilege-escalation-vulnerability?_s_id=cve, which is the authoritative reference for confirming the exact fixed release.

RemediationAI

Update the Wholesale Suite plugin to a release newer than 2.2.4.2; the description bounds the vulnerability at 'through <= 2.2.4.2,' but no vendor-released patched version number was included in the provided data, so confirm the exact fixed build via the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-prices/vulnerability/wordpress-wholesale-suite-plugin-2-2-4-2-privilege-escalation-vulnerability?_s_id=cve) or the vendor before deploying. No vendor-released patch version is independently confirmed here beyond the advisory reference. As compensating controls until patched, tighten role assignments so only fully trusted staff hold the elevated WordPress/WooCommerce roles the flaw abuses (reducing the pool of accounts that meet the PR:H precondition), audit existing user roles and remove unexpected administrator/shop-manager grants, and consider a virtual-patch/WAF rule via Patchstack or an equivalent WordPress security layer to block the privileged plugin actions - noting that overly broad WAF rules can break legitimate wholesale-management workflows and role changes may disrupt staff who rely on those capabilities.