WholesaleX <= 3.1.6 - Authenticated (Subscriber+) Account Approval Restriction Bypass via WooCommerce REST API Key Authentication
- ID
- WPSEC-2026-2270
- Plugin
- WholesaleX – Wholesale Pricing & B2B Solution (wholesalex)
- Affected
- all versions before 3.1.7
- Remediation
- Update to 3.1.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- WholesaleX on WPSec AttackSurface
- Fix released
- Published
Description
The WholesaleX plugin for WordPress is vulnerable to an account approval restriction bypass via WooCommerce REST API key authentication in all versions up to, and including, 3.1.6. This is due to the plugin checking pending, rejected or inactive account status only in a 'determine_current_user' filter, while WooCommerce's REST authentication fallback can authenticate an API key on the 'rest_authentication_errors' filter and set the current user directly with wp_set_current_user(), skipping that check. This makes it possible for authenticated attackers whose account is pending approval, rejected or deactivated, but who hold WooCommerce REST API keys issued earlier, to keep using the WooCommerce REST API with that account's permissions despite the site owner's account status restrictions.
References
- https://wpsec.com/vuln/WPSEC-2026-2270/
- https://plugins.svn.wordpress.org/wholesalex/tags/3.1.7/
- https://wordpress.org/plugins/wholesalex/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS