# WholesaleX <= 3.1.4 - Unauthenticated Missing Authorization to Multisite Site Membership via Login Form

- **ID:** WPSEC-2026-1484
- **Plugin:** WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) (`wholesalex`), https://wordpress.org/plugins/wholesalex/
- **Affected versions:** all versions before 3.1.5
- **Fixed in:** 3.1.5 (Update to 3.1.5 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wholesalex
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1484/

## Description

The WholesaleX plugin for WordPress is vulnerable to unauthorized modification of data via the wholesalex_process_login AJAX action in all versions up to, and including, 3.1.4, due to the handler adding the named network user to the current site with the customer role before checking the submitted password. This makes it possible for unauthenticated attackers on WordPress multisite networks to add any existing network user to the current site as a customer without knowing that user's credentials.

## References

- https://wpsec.com/vuln/WPSEC-2026-1484/
- https://plugins.svn.wordpress.org/wholesalex/tags/3.1.5/
- https://wordpress.org/plugins/wholesalex/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1484/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.