Wholesale for WooCommerce CVE-2026-12144

Requires an authenticated account at author level or above on a site running Wholesale for WooCommerce ≤2.0.5, and that account must have authored a wwp_requests post so it can access the request_user_role_nonce rendered in the meta box on the wwp_requests edit screen (obtainable through the plugin's wholesale registration workflow). Because the wwp_requests post type is registered with capability_type => 'post', ordinary author-level capabilities suffice. Limiting factors: the plugin must be installed and active, the attacker needs a foothold account (PR:L, not fully anonymous), and must possess/create a wwp_requests post to obtain the nonce. There is no capability check (no promote_users/manage_options) and no allowlist against permitted wholesale roles, so supplying 'administrator' as user_role_set succeeds; no victim user interaction is required (UI:N).

This is a genuine high-priority privilege escalation, well-calibrated at CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals are internally consistent: the vector correctly reflects a network-reachable, low-complexity flaw requiring some authentication (PR:L, author-level), and the C:H/I:H/A:H impact is justified because the outcome is full administrator control of the WordPress site - total takeover, not a partial compromise. SSVC agrees on Technical Impact: total. However, the secondary signals temper urgency: EPSS is only 0.37% (29th percentile), SSVC Exploitation is 'none', Automatable is 'no', there is no CISA KEV listing, and no public exploit code was identified. The 'not automatable' rating is accurate because exploitation requires an attacker to first obtain an author-level account AND to have authored a wwp_requests post - a per-target, human-driven precondition rather than a mass-scannable one. Net: a serious, fully-impactful vulnerability that warrants prompt patching wherever the plugin is installed, but current real-world exploitation pressure is low and any attack would be targeted rather than widespread. No conflicting data was found between the CVSS vector and the description.

An attacker who holds (or registers for) an author-level account on a WordPress site running Wholesale for WooCommerce ≤2.0.5 - for example via the plugin's own wholesale registration form - authors a wwp_requests post and opens its edit screen to harvest the request_user_role_nonce. They then submit a crafted POST setting user_role_set to 'administrator', which save_requests_meta() passes unvalidated to WP_User::add_role(), granting them the administrator role and full site control. No public proof-of-concept was identified at time of analysis.