{
 "id": "WPSEC-2026-1484",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1484/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1484/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1484/index.md",
 "title": "WholesaleX <= 3.1.4 - Unauthenticated Missing Authorization to Multisite Site Membership via Login Form",
 "description": "The WholesaleX plugin for WordPress is vulnerable to unauthorized modification of data via the wholesalex_process_login AJAX action in all versions up to, and including, 3.1.4, due to the handler adding the named network user to the current site with the customer role before checking the submitted password. This makes it possible for unauthenticated attackers on WordPress multisite networks to add any existing network user to the current site as a customer without knowing that user's credentials.",
 "plugin": {
  "slug": "wholesalex",
  "name": "WholesaleX",
  "full_name": "WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing)",
  "wordpress_org": "https://wordpress.org/plugins/wholesalex/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wholesalex/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wholesalex"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.5",
 "remediation": "Update to 3.1.5 or later.",
 "fix_released": "2026-10-22T04:23:32+00:00",
 "published": "2026-10-23T04:43:51+00:00",
 "updated": "2026-10-22T10:09:32.846464+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1484/",
  "https://plugins.svn.wordpress.org/wholesalex/tags/3.1.5/",
  "https://wordpress.org/plugins/wholesalex/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wholesalex",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}