EUVD-2026-59594
GHSA-wv24-4cw2-5gxg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network AJAX vector, low attacker complexity once feature is enabled, Subscriber authentication required, full impact on WordPress site with no scope change.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option.
AnalysisAI
Privilege escalation in the Wholesale Market WordPress plugin (versions up to and including 2.2.2) allows any authenticated user with Subscriber-level access or higher to elevate their account to Administrator by supplying an arbitrary role name to a poorly validated AJAX endpoint. The ced_wholesale_request_send_callback() handler accepts a client-controlled role_required POST parameter and passes it directly to WP_User::add_role() without an allowlist, relying solely on a nonce that is freely exposed to all authenticated users via wp_localize_script. No public exploit has been identified at time of analysis, but the low attack complexity combined with Subscriber-level access requirement makes this a realistic and attractive target on sites with the vulnerable configuration option active.
Technical ContextAI
The vulnerability is classified as CWE-269 (Improper Privilege Management), arising from the plugin's wholesale user registration addon (class-wholesale-user-register-addon.php). WordPress AJAX actions use nonce tokens to validate request authenticity, but when nonces are embedded in frontend page scripts via wp_localize_script, every authenticated session holder can retrieve them - rendering nonce verification an ineffective access control mechanism in this context. The handler verifies a nonce and checks for a positive user ID (confirming any logged-in user), then invokes the native WordPress WP_User::add_role() function with the raw role_required value from the POST body. Since no allowlist restricts the accepted role values, an attacker can supply 'administrator' or any other WordPress role string, instantly gaining the associated capabilities. The affected code is present in the plugin's Trac repository at the referenced line numbers (L141, L153, L276, L30) of the 2.2.2 tag.
RemediationAI
No fixed version is identified in the provided source data - administrators should consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/abd59d7a-e7f6-440d-9c2a-00266c0dcbff for patch availability and the WordPress.org plugin page for an updated release. As an immediate and effective compensating control, disable the 'Assigning requested role directly' option in the Wholesale Market plugin settings; this removes the code path that calls WP_User::add_role() with client-supplied input and fully mitigates the vulnerability, though it will prevent automated role assignment for wholesale requests, requiring manual role management instead. If the feature must remain active, consider temporarily deactivating the plugin until a patched version is released. Additionally, audit existing user accounts for unexpected Administrator-level privileges that may indicate prior exploitation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today