Wholesalex
Monthly
Unauthenticated attackers can retrieve the most recently imported user dataset from WordPress sites running the WholesaleX plugin before 3.0.9, because the plugin leaves its user-import file in a web-accessible directory under a predictable filename. Exposed records can include account passwords together with customer contact and address details. Exploitation is conditional: an administrator must already have run the import feature and the file must not have been overwritten or cleaned up, which is why the assessed vector rates attack complexity High and SSVC marks the issue non-automatable; publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified as being used in the wild at time of analysis.
Unauthenticated attackers can activate pending WholesaleX accounts on WordPress sites running plugin versions before 3.0.9 by supplying a request that satisfies the plugin's confirmation-code comparison against an unset stored value, bypassing the administrator approval normally required before login. Publicly available exploit code exists, but the supplied SSVC assessment records exploitation as none and technical impact as partial; the issue is remotely reachable with no credentials or user interaction under the default approval configuration. The practical risk is moderate because a successful attack can activate an existing pending account and alter its login state, with low confidentiality and integrity impact and no availability impact.
Improper Privilege Management vulnerability in Wholesale WholesaleX allows Privilege Escalation.3.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.3.2. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Wholesale Team WholesaleX.3.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wholesale Team WholesaleX.3.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated attackers can retrieve the most recently imported user dataset from WordPress sites running the WholesaleX plugin before 3.0.9, because the plugin leaves its user-import file in a web-accessible directory under a predictable filename. Exposed records can include account passwords together with customer contact and address details. Exploitation is conditional: an administrator must already have run the import feature and the file must not have been overwritten or cleaned up, which is why the assessed vector rates attack complexity High and SSVC marks the issue non-automatable; publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified as being used in the wild at time of analysis.
Unauthenticated attackers can activate pending WholesaleX accounts on WordPress sites running plugin versions before 3.0.9 by supplying a request that satisfies the plugin's confirmation-code comparison against an unset stored value, bypassing the administrator approval normally required before login. Publicly available exploit code exists, but the supplied SSVC assessment records exploitation as none and technical impact as partial; the issue is remotely reachable with no credentials or user interaction under the default approval configuration. The practical risk is moderate because a successful attack can activate an existing pending account and alter its login state, with low confidentiality and integrity impact and no availability impact.
Improper Privilege Management vulnerability in Wholesale WholesaleX allows Privilege Escalation.3.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.3.2. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Wholesale Team WholesaleX.3.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wholesale Team WholesaleX.3.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.