CVE-2026-8145 — WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and inclu…
Published: 2026-10-15 · CVSS: 5.4 · CVSS 3.1
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7