{
 "id": "WPSEC-2026-1483",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1483/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1483/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1483/index.md",
 "title": "WholesaleX <= 3.1.4 - Authenticated (Administrator+) Privilege Escalation via Customer CSV Import on Multisite",
 "description": "The WholesaleX plugin for WordPress is vulnerable to Privilege Escalation via the customer CSV import feature in all versions up to, and including, 3.1.4, due to the import handler checking only the manage_options capability and not checking whether the importing user may edit each targeted account. Accounts are looked up network-wide by username or email, so any user can be targeted, including users who do not belong to the current site and network super administrators. This makes it possible for authenticated attackers with site Administrator-level access on a WordPress multisite network to change the password, email address and WholesaleX role or status of any network user, including super administrators, and take over those accounts.",
 "plugin": {
  "slug": "wholesalex",
  "name": "WholesaleX",
  "full_name": "WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing)",
  "wordpress_org": "https://wordpress.org/plugins/wholesalex/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wholesalex/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wholesalex"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-269"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.5",
 "remediation": "Update to 3.1.5 or later.",
 "fix_released": "2026-10-22T04:23:32+00:00",
 "published": "2026-10-23T04:43:51+00:00",
 "updated": "2026-10-22T10:09:32.846464+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1483/",
  "https://plugins.svn.wordpress.org/wholesalex/tags/3.1.5/",
  "https://wordpress.org/plugins/wholesalex/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wholesalex",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}