Vulnerabilities / Wholesale Suite / WPSEC-2026-1684
Wholesale Suite <= 2.3.0 - Unauthenticated Sensitive Information Exposure via 'wholesale_role' Parameter
Medium 5.3
CWE-639Fixed in 2.3.1
- ID
- WPSEC-2026-1684
- Plugin
- Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices (woocommerce-wholesale-prices)
- Affected
- all versions before 2.3.1
- Remediation
- Update to 2.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- Wholesale Suite on WPSec AttackSurface
- Fix released
- Published
Description
The Wholesale Suite plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'wholesale_role' parameter in all versions up to, and including, 2.3.0. This is due to the plugin taking the wholesale role from the user-supplied 'wholesale_role' request parameter, without checking it against the current user, when it renders product price HTML for any REST API request, including the public WooCommerce Store API product routes. This makes it possible for unauthenticated attackers to view the wholesale prices of any wholesale role, which are meant only for approved wholesale customers.
References
- https://wpsec.com/vuln/WPSEC-2026-1684/
- https://plugins.svn.wordpress.org/woocommerce-wholesale-prices/tags/2.3.1/
- https://wordpress.org/plugins/woocommerce-wholesale-prices/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS