{
 "id": "WPSEC-2026-2270",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2270/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2270/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2270/index.md",
 "title": "WholesaleX <= 3.1.6 - Authenticated (Subscriber+) Account Approval Restriction Bypass via WooCommerce REST API Key Authentication",
 "description": "The WholesaleX plugin for WordPress is vulnerable to an account approval restriction bypass via WooCommerce REST API key authentication in all versions up to, and including, 3.1.6. This is due to the plugin checking pending, rejected or inactive account status only in a 'determine_current_user' filter, while WooCommerce's REST authentication fallback can authenticate an API key on the 'rest_authentication_errors' filter and set the current user directly with wp_set_current_user(), skipping that check. This makes it possible for authenticated attackers whose account is pending approval, rejected or deactivated, but who hold WooCommerce REST API keys issued earlier, to keep using the WooCommerce REST API with that account's permissions despite the site owner's account status restrictions.",
 "plugin": {
  "slug": "wholesalex",
  "name": "WholesaleX",
  "full_name": "WholesaleX – Wholesale Pricing & B2B Solution",
  "wordpress_org": "https://wordpress.org/plugins/wholesalex/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wholesalex/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wholesalex"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.2,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.7",
 "remediation": "Update to 3.1.7 or later.",
 "fix_released": "2026-11-01T08:50:46+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:22:35.806963+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2270/",
  "https://plugins.svn.wordpress.org/wholesalex/tags/3.1.7/",
  "https://wordpress.org/plugins/wholesalex/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wholesalex",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}