Wholesalex All In One B2B Solution With Wholesale Pricing
Monthly
The WholesaleX B2B/wholesale plugin for WooCommerce (up to and including 3.0.8) fails to validate the 'wholesalex_registration_role' parameter handled by 'process_registration', letting an attacker submit a registration with a role of their choosing and thereby self-assign any already-existing WholesaleX wholesale/B2B role. Impact is bounded - the escalation is limited to the plugin's own role tiers and does not reach arbitrary WordPress roles such as administrator - and the independent assessment rates it a moderate, not top-tier, priority (reassessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Authentication requirements are not fully resolved from the available data: the vendor description and the independent reassessment treat the attacker as unauthenticated, while the originally published CVSS vector carries PR:L. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
The WholesaleX B2B/wholesale plugin for WooCommerce (up to and including 3.0.8) fails to validate the 'wholesalex_registration_role' parameter handled by 'process_registration', letting an attacker submit a registration with a role of their choosing and thereby self-assign any already-existing WholesaleX wholesale/B2B role. Impact is bounded - the escalation is limited to the plugin's own role tiers and does not reach arbitrary WordPress roles such as administrator - and the independent assessment rates it a moderate, not top-tier, priority (reassessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Authentication requirements are not fully resolved from the available data: the vendor description and the independent reassessment treat the attacker as unauthenticated, while the originally published CVSS vector carries PR:L. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV.