# WholesaleX <= 3.1.4 - Authenticated (Administrator+) Privilege Escalation via Customer CSV Import on Multisite

- **ID:** WPSEC-2026-1483
- **Plugin:** WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) (`wholesalex`), https://wordpress.org/plugins/wholesalex/
- **Affected versions:** all versions before 3.1.5
- **Fixed in:** 3.1.5 (Update to 3.1.5 or later.)
- **Severity:** Medium 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wholesalex
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1483/

## Description

The WholesaleX plugin for WordPress is vulnerable to Privilege Escalation via the customer CSV import feature in all versions up to, and including, 3.1.4, due to the import handler checking only the manage_options capability and not checking whether the importing user may edit each targeted account. Accounts are looked up network-wide by username or email, so any user can be targeted, including users who do not belong to the current site and network super administrators. This makes it possible for authenticated attackers with site Administrator-level access on a WordPress multisite network to change the password, email address and WholesaleX role or status of any network user, including super administrators, and take over those accounts.

## References

- https://wpsec.com/vuln/WPSEC-2026-1483/
- https://plugins.svn.wordpress.org/wholesalex/tags/3.1.5/
- https://wordpress.org/plugins/wholesalex/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1483/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.