CVE-2026-12144
Received Received - Intake

Privilege Escalation in Wholesale for WooCommerce WordPress Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Wordfence

Description
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the `save_requests_meta()` function applying only `sanitize_text_field()` to the `user_role_set` POST parameter before passing it directly to `WP_User::add_role()`, with no allowlist validation against permitted wholesale roles and no capability check such as `current_user_can('promote_users')` or `current_user_can('manage_options')`. This makes it possible for authenticated attackers with author-level access and above to escalate their privileges to administrator by supplying `administrator` as the `user_role_set` value in a crafted request. The function is gated only by a nonce (`request_user_role_nonce`) that is rendered in the meta box on the `wwp_requests` post edit screen; because the post type is registered with `capability_type => 'post'`, any author-level user who has authored a `wwp_requests` post — such as one created via the wholesale registration form — can access this nonce and submit the role-assignment request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-29
Last Modified
2026-07-29
Generated
2026-07-29
AI Q&A
2026-07-29
EPSS Evaluated
N/A
NVD
CVE-2026-12144
EUVD
EUVD-2026-50097

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce wholesale_for_woocommerce to 2.0.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Wholesale for WooCommerce plugin for WordPress has a privilege escalation vulnerability in versions up to 2.0.5. The issue is in the save_requests_meta() function, which does not properly validate the user_role_set parameter before assigning user roles. This allows authenticated attackers with author-level access or higher to escalate their privileges to administrator by submitting a crafted request.

Detection Guidance

Check WordPress sites with the Wholesale for WooCommerce plugin versions up to 2.0.5 for unauthorized privilege escalation attempts. Inspect server logs for POST requests to wp-admin/admin-ajax.php with user_role_set=administrator and the request_user_role_nonce parameter. Review user roles in the database for unexpected administrator accounts.

Impact Analysis

This vulnerability allows attackers with basic user access to gain full administrative control over a WordPress site. Once escalated, attackers can install malicious plugins, steal data, or take complete control of the website.

Compliance Impact

This vulnerability allows authenticated attackers with author-level access to escalate privileges to administrator. This could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's access control mandates.

Mitigation Strategies

Update the Wholesale for WooCommerce plugin to the latest version. Remove any unauthorized administrator accounts. Implement strict input validation for user role assignments. Restrict access to the wholesale registration form and related meta boxes. Monitor for suspicious privilege changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart