WholesaleX EUVD-2026-102020

Requires that the WholesaleX registration workflow ('process_registration', the role-based B2B registration feature) is enabled and publicly reachable, which is its default purpose on any store using the plugin. The attacker manipulates the 'wholesalex_registration_role' request parameter during registration; the vulnerable code path exists in all versions up to and including 3.0.8. Exploitation is LIMITED in scope - the attacker can only self-assign an already-existing WholesaleX role (wholesale/B2B tiers), not arbitrary WordPress roles such as administrator - and version 2.3.8 only partially remediates it, so a fully patched later version is needed. Note the unresolved conflict over whether authentication is required (description says unauthenticated; supplied CVSS says PR:L).

This is a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity flaw with only partial confidentiality and integrity impact and no availability impact, consistent with CWE-269 (Improper Privilege Management). A key conflict exists in the source data: the vendor description states 'unauthenticated attackers' can register as any existing WholesaleX role, yet the supplied CVSS vector encodes PR:L (low-privilege authenticated attacker) - these disagree, and the description's unauthenticated self-registration path is the more plausible reading since the issue lives in a public 'process_registration' handler; verify the privilege precondition with Wordfence. No exploitation-likelihood signals were provided: EPSS is absent, the CVE is not in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The impact is deliberately bounded - an attacker can only assign themselves an existing WholesaleX customer/wholesale role, not a WordPress administrator role - which is why it is labeled 'Limited Privilege Escalation' and rated only Medium. Real-world risk is therefore contained to unauthorized access to wholesale pricing, B2B discounts, and role-gated store content rather than full site compromise.

An attacker browses to the store's WholesaleX registration form and submits a registration request while tampering with the 'wholesalex_registration_role' parameter, because the plugin fails to validate that value server-side. The response grants the attacker an existing privileged WholesaleX role (e.g., an approved wholesale/B2B tier), giving immediate access to member-only wholesale pricing and role-restricted content. No public exploit code is identified at time of analysis, but the technique is trivial to reproduce with any HTTP intercepting proxy.