What is the CVSS score of CVE-2026-27542?

CVE-2026-27542 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Woocommerce Wholesale Lead Capture are affected by CVE-2026-27542?

All WordPress sites running the WooCommerce Wholesale Lead Capture plugin (versions through 2.0.3.1) face critical risk of unauthorized admin account creation by unauthenticated attackers.

Is there a public PoC exploit available for CVE-2026-27542?

Yes, a public proof-of-concept exploit is available for CVE-2026-27542. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27542?

Within 24 hours: Immediately disable and deactivate the WooCommerce Wholesale Lead Capture plugin across all affected WordPress installations; audit admin accounts and access logs for unauthorized activity. Within 7 days: Contact Rymera Web Co for security guidance; evaluate alternative lead capture solutions or request customer notification regarding timeline for patches. Within 30 days: Implement replacement functionality; complete forensic audit of affected sites for evidence of compromise; establish vendor security update monitoring process.

Woocommerce Wholesale Lead Capture CVE-2026-27542

EUVD-2026-13045 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-03-19 Patchstack

WordPress Privilege Escalation Woocommerce Wholesale Lead Capture Wordpress Plugin

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 05:30 euvd

EUVD-2026-13045

Analysis Generated

Mar 19, 2026 - 05:30 vuln.today

CVE Published

Mar 19, 2026 - 05:22 nvd

CRITICAL 9.8

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Escalation.This issue affects Woocommerce Wholesale Lead Capture: from n/a through 2.0.3.1.

AnalysisAI

An incorrect privilege assignment vulnerability exists in the WooCommerce Wholesale Lead Capture plugin for WordPress, allowing unauthenticated attackers to escalate privileges on affected sites. All versions through 2.0.3.1 of the plugin developed by Rymera Web Co Pty Ltd. are vulnerable. With a CVSS score of 9.8 (Critical) and network-based exploitation requiring no privileges or user interaction, this represents a severe security risk for WordPress sites using this plugin.

Technical ContextAI

This vulnerability affects the WooCommerce Wholesale Lead Capture plugin (cpe:2.3:a:rymera_web_co_pty_ltd.:woocommerce_wholesale_lead_capture), a WordPress plugin used to capture wholesale lead information for WooCommerce stores. The root cause is classified under CWE-266 (Incorrect Privilege Assignment), which occurs when software does not properly restrict or incorrectly assigns privileges to actors, allowing them to perform actions they should not be authorized to execute. In WordPress plugins, this typically manifests as insufficient capability checks on administrative functions, allowing lower-privileged or unauthenticated users to execute privileged operations such as user role modification, settings changes, or data manipulation.

RemediationAI

Site administrators should immediately upgrade the WooCommerce Wholesale Lead Capture plugin to a patched version newer than 2.0.3.1 if available from the vendor or WordPress plugin repository. Consult the Patchstack database entry at https://patchstack.com/database/wordpress/plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-privilege-escalation-vulnerability?_s_id=cve for specific remediation guidance and patched version information. If a patch is not yet available or cannot be applied immediately, consider temporarily disabling the plugin and removing it from the WordPress installation until a fix is deployed, especially if the wholesale lead capture functionality is not business-critical. Additionally, implement web application firewall (WAF) rules to restrict access to the plugin's endpoints, monitor WordPress user creation and role modification activities, and conduct a security audit to verify no unauthorized privilege escalation has already occurred.