CVE-2026-27541
Privilege Escalation via Incorrect Privilege Assignment in Wholesale Suite
Publication date: 2026-03-05
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| josh_kohlbach | woocommerce_wholesale_prices | to 2.2.6 (inc) |
| josh_kohlbach | wholesale_suite | to 2.2.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27541 is a medium priority privilege escalation vulnerability in the WordPress Wholesale Suite Plugin versions up to and including 2.2.6.
This vulnerability allows a malicious actor with low-level privileges, such as a shop manager, to escalate their privileges to a higher level, potentially gaining full control over the affected website.
It is classified under the OWASP Top 10 category A7: Identification and Authentication Failures, with a CVSS severity score of 7.2, indicating moderate danger and a likelihood of exploitation.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow a user with limited permissions, such as a shop manager, to gain higher-level privileges on the website.
This privilege escalation can lead to the attacker gaining full control over the affected WordPress site, potentially allowing them to modify content, access sensitive data, or disrupt site operations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about commands or methods to detect this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is currently available for this vulnerability, it is recommended to implement the mitigation rule issued by Patchstack immediately to block attacks exploiting this flaw.
Applying this mitigation will help protect your site until an official patch is released, tested, and safely applied.