Vulnerabilities / WholesaleX / WPSEC-2026-1484
WholesaleX <= 3.1.4 - Unauthenticated Missing Authorization to Multisite Site Membership via Login Form
Low 3.7
CWE-862Fixed in 3.1.5
- ID
- WPSEC-2026-1484
- Plugin
- WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) (wholesalex)
- Affected
- all versions before 3.1.5
- Remediation
- Update to 3.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- WholesaleX on WPSec AttackSurface
- Fix released
- Published
Description
The WholesaleX plugin for WordPress is vulnerable to unauthorized modification of data via the wholesalex_process_login AJAX action in all versions up to, and including, 3.1.4, due to the handler adding the named network user to the current site with the customer role before checking the submitted password. This makes it possible for unauthenticated attackers on WordPress multisite networks to add any existing network user to the current site as a customer without knowing that user's credentials.
References
- https://wpsec.com/vuln/WPSEC-2026-1484/
- https://plugins.svn.wordpress.org/wholesalex/tags/3.1.5/
- https://wordpress.org/plugins/wholesalex/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS