{
 "id": "WPSEC-2026-1684",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1684/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1684/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1684/index.md",
 "title": "Wholesale Suite <= 2.3.0 - Unauthenticated Sensitive Information Exposure via 'wholesale_role' Parameter",
 "description": "The Wholesale Suite plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'wholesale_role' parameter in all versions up to, and including, 2.3.0. This is due to the plugin taking the wholesale role from the user-supplied 'wholesale_role' request parameter, without checking it against the current user, when it renders product price HTML for any REST API request, including the public WooCommerce Store API product routes. This makes it possible for unauthenticated attackers to view the wholesale prices of any wholesale role, which are meant only for approved wholesale customers.",
 "plugin": {
  "slug": "woocommerce-wholesale-prices",
  "name": "Wholesale Suite",
  "full_name": "Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-wholesale-prices/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-wholesale-prices/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-wholesale-prices"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.3.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.3.1",
 "remediation": "Update to 2.3.1 or later.",
 "fix_released": "2026-10-26T00:35:24+00:00",
 "published": "2026-10-27T00:42:20+00:00",
 "updated": "2026-10-26T09:31:14.245875+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1684/",
  "https://plugins.svn.wordpress.org/woocommerce-wholesale-prices/tags/2.3.1/",
  "https://wordpress.org/plugins/woocommerce-wholesale-prices/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-wholesale-prices",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-27"
 }
}