Wholesale Market CVE-2026-14279

Exploitation requires three concrete conditions to be simultaneously true: (1) the target WordPress site must have the Wholesale Market plugin installed and active at version 2.2.2 or earlier; (2) the site administrator must have explicitly enabled the 'Assigning requested role directly' option in the plugin configuration - this is not the default state and represents a deliberate admin choice; (3) the attacker must possess at minimum a Subscriber-level authenticated account on the target site. The nonce that the handler validates is embedded in frontend page output via wp_localize_script and is therefore accessible to any logged-in user, making it a non-barrier. Exploitation is limited to authenticated users (PR:L per CVSS) and is entirely blocked when the 'Assigning requested role directly' configuration flag is disabled.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat profile when the vulnerable feature is active. Attack vector is network (AJAX endpoint), complexity is low (nonce is trivially retrievable), privileges required are low (Subscriber), and impact is full across confidentiality, integrity, and availability given Administrator-level access to the WordPress site. However, a critical limiting factor is that exploitation requires the site administrator to have explicitly enabled the 'Assigning requested role directly' option - a non-default plugin configuration. This deployment-dependent condition meaningfully reduces real-world risk compared to the raw CVSS score implies. No EPSS score was provided in the source data, and the CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation signal exists. For sites where the configuration flag is disabled, this vulnerability is not exploitable. For sites where it is enabled, the attack is straightforward and should be treated as a high priority.

An attacker registers or obtains a Subscriber-level account on a target WordPress site running Wholesale Market ≤ 2.2.2 with 'Assigning requested role directly' enabled, then loads any frontend page where the plugin enqueues its script to extract the nonce value from the page source. The attacker sends a crafted HTTP POST request to the WordPress admin-ajax.php endpoint targeting the ced_wholesale_request_send action with the role_required parameter set to 'administrator', immediately receiving Administrator privileges on the site with full access to all content, users, and settings. No publicly available exploit code was identified at time of analysis, but the attack requires no special tooling.