PT-2026-65676 · Saadiqbal · Wholesale For Woocommerce
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the
save requests meta() function applying only sanitize text field() to the user role set POST parameter before passing it directly to WP User::add role(), with no allowlist validation against permitted wholesale roles and no capability check such as current user can('promote users') or current user can('manage options'). This makes it possible for authenticated attackers with author-level access and above to escalate their privileges to administrator by supplying administrator as the user role set value in a crafted request. The function is gated only by a nonce (request user role nonce) that is rendered in the meta box on the wwp requests post edit screen; because the post type is registered with capability type => 'post', any author-level user who has authored a wwp requests post — such as one created via the wholesale registration form — can access this nonce and submit the role-assignment request.Fix
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wholesale For Woocommerce