CVE-2026-8145 in WholesaleX Plugin
Summary
by MITRE • 10/15/2026
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The WholesaleX – B2B & Wholesale Plugin for WooCommerce, a widely used extension for WordPress that facilitates business-to-business sales and wholesale pricing structures, contains a critical access control flaw affecting all versions up to and including 3.0.8. This vulnerability manifests as a limited privilege escalation issue rooted in the registration workflow, specifically within the process_registration function. The core technical deficiency lies in the absence of proper validation or authorization checks for the wholesalex_registration_role parameter during user account creation. Because this input field is not sanitized against an allowlist of permitted roles nor verified against the current site's permission schema, the application blindly accepts any role string submitted by the client side and assigns it to the newly created user account without verifying if that assignment is legitimate or authorized for a public registration context.
From a technical perspective, this flaw represents a classic case of insecure direct object reference combined with insufficient server-side validation. In standard WordPress operations, new users are typically assigned default roles such as Subscriber unless explicitly managed by an administrator through secure administrative interfaces. However, the WholesaleX plugin exposes its internal role assignment logic to unauthenticated actors via the public-facing registration form. An attacker can manipulate HTTP requests during the sign-up process to inject arbitrary role identifiers corresponding to higher-privilege wholesale tiers or even standard WordPress roles like Editor or Administrator if those are mapped within the plugin's configuration. This bypasses the intended security boundary that separates public user acquisition from administrative privilege management, allowing a malicious actor to elevate their access level immediately upon account creation without needing prior authentication credentials for privileged functions.
The operational impact of this vulnerability is significant because it grants unauthenticated attackers the ability to register as any existing WholesaleX role defined in the system. This capability undermines the integrity of B2B pricing models and user segmentation strategies that rely on strict role-based access control. Attackers can exploit these elevated roles to view wholesale-specific product prices, access restricted customer data, or potentially interact with backend features depending on how those specific roles are configured within the WooCommerce ecosystem. Furthermore, since this is a registration-time vulnerability, it does not require an existing account or prior compromise of credentials, making it highly exploitable by automated scanning tools and opportunistic attackers seeking to establish persistent footholds in WordPress environments running vulnerable versions of WholesaleX.
This issue aligns with CWE-269, which describes Improper Privilege Assignment, as the system fails to ensure that users are assigned only the privileges they are entitled to based on their verified identity or authorization level. Additionally, it relates to CWE-749, where a less privileged actor is granted access to security-critical data or resources due to flawed role assignment logic. In terms of offensive cybersecurity frameworks such as MITRE ATT&CK, this vulnerability facilitates the Initial Access and Privilege Escalation tactics by allowing an attacker to gain unauthorized account creation with elevated permissions, which can serve as a stepping stone for further exploitation within the WordPress environment.
To mitigate this risk, site administrators must immediately update the WholesaleX plugin to version 3.0.9 or later, where the validation logic has been corrected to enforce strict allowlisting of permissible roles during registration and ensure that role assignments are validated against server-side permissions rather than client-supplied input. Until an upgrade is feasible, temporary mitigations include restricting public user registration entirely through WordPress settings if not required for business operations, or implementing a web application firewall rule set that monitors and blocks registration requests containing suspicious role parameter values indicative of privilege escalation attempts. Regular auditing of user roles and enforcement of the principle of least privilege across all B2B plugins are also recommended to minimize the attack surface associated with such configuration flaws.