Security Alert Summary
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices contains a limited privilege escalation vulnerability that allows unauthenticated attackers to register with arbitrary WholesaleX roles. The issue is related to missing validation of a registration role parameter in the plugin’s registration processing routine.
CVE Details
- CVE ID: CVE-2026-8145
- Affected component: WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices (WholesaleX)
- Affected versions: All versions up to and including 3.0.8 (as reported). The issue was partially patched in version 2.3.8 (per the description).
- Published: October 15, 2026 at 12:16:39 PM
- Last modified: October 15, 2026 at 2:45:38 PM
- CVSS v3.1: Base Score 5.4, Severity MEDIUM;
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Authentication / privileges / user interaction: No user interaction required. Privileges required: LOW (an attacker can exploit registration); Authentication: not required for exploitation of the described registration path.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness: CWE-269 (Improper Privilege Management)
Technical Details
The vulnerability is a limited privilege escalation in the plugin’s registration flow. The plugin’s process_registration routine fails to validate the wholesalex_registration_role parameter, allowing an unauthenticated actor to submit a registration request that assigns any existing WholesaleX role to the new account. As a result, an attacker can register accounts with roles intended for higher-privilege wholesale users.
References in the report point to the plugin registration class (class-wholesalex-registration.php) where the missing validation occurs. The impact is constrained to role assignment during registration; it does not by itself indicate code execution or host-level compromise. However, accounts created with elevated roles may gain access to features or data intended for trusted wholesale users.
How This Could Impact Your Website
Imagine a site owner who runs a WooCommerce store with WholesaleX enabled, internal staff who manage orders and pricing, and external contractors who assist with catalog updates. An unauthenticated attacker could register and obtain a WholesaleX role intended for business customers or partners. With that role an attacker might view or interact with wholesale-specific areas of the site, increasing the chance of exposing internal contact details or order information tied to wholesale workflows.
Practical consequences include exposure of internal user email addresses and contact details associated with wholesale workflows, and an increased risk of targeted phishing or social engineering against staff and partners who are listed or reachable via those accounts. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and wholesale-type roles that grant access to sensitive data.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and new account registrations for unusual behavior, such as unexpected wholesale-role signups.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wholesalex/tags/2.3.7/includes/menu/class-wholesalex-registration.php#L1327
- https://plugins.trac.wordpress.org/browser/wholesalex/trunk/includes/menu/class-wholesalex-registration.php#L1327
- https://plugins.trac.wordpress.org/changeset/3529605/
- https://plugins.trac.wordpress.org/changeset/3703929/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b9464c-dcc4-4ae8-816f-1572f84dfe08?source=cve
