CVE-2026-14279

Deferred Deferred - Pending Action

Privilege Escalation in Wholesale Market WordPress Plugin

Publication date: 2026-08-15

Last updated on: 2026-08-18

Assigner: Wordfence

Description

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-18

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-14279

EUVD

EUVD-2026-59594

Affected Vendors & Products

Vendor	Product	Version / Range
woocommerce	wholesale_market	to 2.2.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

The Wholesale Market plugin for WordPress has a privilege escalation vulnerability in versions up to 2.2.2. An AJAX action ced_wholesale_request_send_callback allows authenticated users with Subscriber access or higher to elevate their privileges to Administrator by exploiting a nonce exposure and insufficient role validation. The plugin fails to restrict the role_required parameter to approved wholesale roles, enabling attackers to assign themselves any role.

Detection Guidance

Check WordPress sites using the Wholesale Market plugin version 2.2.2 or lower. Look for unauthorized privilege escalations by reviewing user role changes in logs. No specific commands are provided in the context.

Impact Analysis

If you use the vulnerable plugin, attackers with basic user access could gain full administrative control of your WordPress site. This could lead to complete site takeover, data theft, malware installation, or disruption of services. The impact depends on the site's configuration and whether the 'Assigning requested role directly' option is enabled.

Compliance Impact

This vulnerability could severely impact compliance by allowing unauthorized users to gain administrative access. For GDPR, it risks unauthorized data access or processing. For HIPAA, it could expose protected health information. Both require strict access controls, which this vulnerability undermines by enabling privilege escalation.

Mitigation Strategies

Update the Wholesale Market plugin to the latest version. Disable the 'Assigning requested role directly' option in plugin settings. Review user roles for unauthorized changes and remove suspicious Administrator accounts.

Hi! I’m here to help you understand CVE-2026-14279. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70