CVE-2026-27542
Privilege Escalation via Incorrect Privilege Assignment in Woocommerce Wholesale Lead Capture
Publication date: 2026-03-19
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rymera_web_co | woocommerce_wholesale_lead_capture | to 2.0.3.1 (inc) |
| rymera_web_co | woocommerce_wholesale_lead_capture | 2.0.3.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27542 is a critical privilege escalation vulnerability found in the WordPress WooCommerce Wholesale Lead Capture Plugin versions up to and including 2.0.3.1.
This flaw allows an unauthenticated attacker with low privileges to escalate their access rights to higher privileges, potentially gaining full control over the affected website.
It falls under the OWASP Top 10 category A7: Identification and Authentication Failures and has a very high severity score of 9.8.
The vulnerability is actively exploited and can be mitigated by updating the plugin to version 2.0.3.2 or later.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to escalate their privileges from low or unauthenticated access to higher privileges, potentially gaining full control over your website.
Such control can lead to unauthorized changes, data theft, site defacement, or further exploitation of your system.
Because it is actively exploited and has a high severity score, the risk of compromise is significant if the plugin is not updated.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the WooCommerce Wholesale Lead Capture Plugin to version 2.0.3.2 or later.
Until the plugin is updated, you can use mitigation rules provided by Patchstack to block attacks targeting this vulnerability.
Patchstack also offers automatic updates for vulnerable plugins to ensure rapid protection.