EUVD-2026-50097
GHSA-fgx3-jj2q-3c9j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Remote, low-complexity; PR:L because an author-level account plus an authored wwp_requests post is required; escalation to administrator yields full C/I/A impact, scope unchanged within WordPress.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the save_requests_meta() function applying only sanitize_text_field() to the user_role_set POST parameter before passing it directly to WP_User::add_role(), with no allowlist validation against permitted wholesale roles and no capability check such as current_user_can('promote_users') or current_user_can('manage_options'). This makes it possible for authenticated attackers with author-level access and above to escalate their privileges to administrator by supplying administrator as the user_role_set value in a crafted request. The function is gated only by a nonce (request_user_role_nonce) that is rendered in the meta box on the wwp_requests post edit screen; because the post type is registered with capability_type => 'post', any author-level user who has authored a wwp_requests post - such as one created via the wholesale registration form - can access this nonce and submit the role-assignment request.
Articles & Coverage 1
AnalysisAI
Privilege escalation in the Wholesale for WooCommerce WordPress plugin (all versions up to and including 2.0.5) lets any authenticated author-level user promote their own account to administrator, giving full control of the WordPress site. The save_requests_meta() handler runs the user_role_set POST parameter through only sanitize_text_field() and hands it straight to WP_User::add_role() with no allowlist of permitted wholesale roles and no current_user_can('promote_users') or manage_options check, while the request_user_role_nonce that gates the call is reachable by any author who has authored a wwp_requests post (obtainable through the plugin's own wholesale registration form). No public exploit identified at time of analysis - EPSS is 0.37% (29th percentile) and CISA SSVC records exploitation as 'none' - but the assessed technical impact is total once the low-privilege foothold requirement is satisfied, and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is faithfully reflected here.
Technical ContextAI
The flaw is an instance of CWE-269 (Improper Privilege Management) in the WooCommerce wholesale-pricing plugin (slug woo-wholesale-pricing, main class file inc/class-wwp-wholesale-requests.php). WordPress roles are stored per user in the wp_capabilities usermeta key, and WP_User::add_role() appends a role without removing existing ones, so an attacker does not need to break anything - they simply add 'administrator' alongside their existing author role and the elevated capabilities are live immediately. The vulnerable code path (save_requests_meta(), around lines 274/369/397) is reached from the meta box rendered on the wwp_requests custom-post edit screen. Its only guard is the request_user_role_nonce, and because the wwp_requests post type is registered with capability_type => 'post', WordPress maps its edit capability onto the primitive 'post' capabilities (edit_posts, edit_published_posts), which every author-level user already holds. The nonce is therefore not a security boundary: an attacker with an author account can create or claim a wwp_requests post via the plugin's wholesale registration workflow, load the edit screen, harvest the nonce, and then POST user_role_set=administrator. sanitize_text_field() only strips tags, whitespace and invalid UTF-8 - it performs no semantic validation, so arbitrary role strings pass through unchecked. The missing controls are a hard allowlist of assignable wholesale roles plus a capability gate such as current_user_can('promote_users'), the standard WordPress check for changing another user's role.
RemediationAI
An upstream fix is available in the plugin's Trac changeset 3621257 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3621257%40woo-wholesale-pricing&new=3621257%40woo-wholesale-pricing), which adds the missing validation and capability gate to save_requests_meta(); a released patched version number is not independently confirmed from the supplied data, so administrators should check the plugin's WordPress.org page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/327a155c-7a7d-494d-94d1-f7e7ee8927f0?source=cve) and update to the first release that contains that changeset rather than assuming 2.0.5 is the last affected build. If an update cannot be applied immediately, the highest-value compensating control is to deactivate the Wholesale for WooCommerce plugin - the site loses wholesale pricing and the wholesale registration workflow but the vulnerable code path disappears entirely. Where the plugin must stay live, remove the ability of untrusted roles to create or edit wwp_requests posts (for example via a roles/capabilities editor, granting that post type only to trusted shop-manager accounts) and audit which accounts currently hold author or higher with post-creation rights, since that trade-off breaks self-service wholesale registration for customers. Auditing and preventing non-admin role changes is also advisable: enable WordPress audit logging for the wp_capabilities usermeta key, and deploy a WAF rule that rejects requests containing user_role_set=administrator (or any role token outside the expected wholesale set) to the wwp_requests edit endpoint - accepting that string-matching rules are evadable via encoding and only buy time. Finally, review existing administrators for unexpected promotion, because the vulnerable operation leaves no trace beyond the role change itself.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when up
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today