# WholesaleX <= 3.1.6 - Authenticated (Subscriber+) Account Approval Restriction Bypass via WooCommerce REST API Key Authentication

- **ID:** WPSEC-2026-2270
- **Plugin:** WholesaleX – Wholesale Pricing & B2B Solution (`wholesalex`), https://wordpress.org/plugins/wholesalex/
- **Affected versions:** all versions before 3.1.7
- **Fixed in:** 3.1.7 (Update to 3.1.7 or later.)
- **Severity:** Medium 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wholesalex
- **Fix released:** 2026-11-01
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2270/

## Description

The WholesaleX plugin for WordPress is vulnerable to an account approval restriction bypass via WooCommerce REST API key authentication in all versions up to, and including, 3.1.6. This is due to the plugin checking pending, rejected or inactive account status only in a 'determine_current_user' filter, while WooCommerce's REST authentication fallback can authenticate an API key on the 'rest_authentication_errors' filter and set the current user directly with wp_set_current_user(), skipping that check. This makes it possible for authenticated attackers whose account is pending approval, rejected or deactivated, but who hold WooCommerce REST API keys issued earlier, to keep using the WooCommerce REST API with that account's permissions despite the site owner's account status restrictions.

## References

- https://wpsec.com/vuln/WPSEC-2026-2270/
- https://plugins.svn.wordpress.org/wholesalex/tags/3.1.7/
- https://wordpress.org/plugins/wholesalex/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2270/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.