WholesaleX <= 3.1.4 - Authenticated (Administrator+) Privilege Escalation via Customer CSV Import on Multisite
- ID
- WPSEC-2026-1483
- Plugin
- WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) (wholesalex)
- Affected
- all versions before 3.1.5
- Remediation
- Update to 3.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- WholesaleX on WPSec AttackSurface
- Fix released
- Published
Description
The WholesaleX plugin for WordPress is vulnerable to Privilege Escalation via the customer CSV import feature in all versions up to, and including, 3.1.4, due to the import handler checking only the manage_options capability and not checking whether the importing user may edit each targeted account. Accounts are looked up network-wide by username or email, so any user can be targeted, including users who do not belong to the current site and network super administrators. This makes it possible for authenticated attackers with site Administrator-level access on a WordPress multisite network to change the password, email address and WholesaleX role or status of any network user, including super administrators, and take over those accounts.
References
- https://wpsec.com/vuln/WPSEC-2026-1483/
- https://plugins.svn.wordpress.org/wholesalex/tags/3.1.5/
- https://wordpress.org/plugins/wholesalex/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS