# Wholesale Suite <= 2.3.0 - Unauthenticated Sensitive Information Exposure via 'wholesale_role' Parameter

- **ID:** WPSEC-2026-1684
- **Plugin:** Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices (`woocommerce-wholesale-prices`), https://wordpress.org/plugins/woocommerce-wholesale-prices/
- **Affected versions:** all versions before 2.3.1
- **Fixed in:** 2.3.1 (Update to 2.3.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woocommerce-wholesale-prices
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1684/

## Description

The Wholesale Suite plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'wholesale_role' parameter in all versions up to, and including, 2.3.0. This is due to the plugin taking the wholesale role from the user-supplied 'wholesale_role' request parameter, without checking it against the current user, when it renders product price HTML for any REST API request, including the public WooCommerce Store API product routes. This makes it possible for unauthenticated attackers to view the wholesale prices of any wholesale role, which are meant only for approved wholesale customers.

## References

- https://wpsec.com/vuln/WPSEC-2026-1684/
- https://plugins.svn.wordpress.org/woocommerce-wholesale-prices/tags/2.3.1/
- https://wordpress.org/plugins/woocommerce-wholesale-prices/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1684/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.