What the vulnerability does
01Description
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option.
Explanation of Vulnerability in Simple Terms
02Summary
Wholesale Market versions 2.2.2 and earlier contain a privilege management flaw that allows authenticated users with low privileges to gain unauthorized access to sensitive data and modify or disable site functionality. An attacker with a basic user account can read confidential information, alter critical settings, or disrupt service availability without requiring additional user interaction.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify site settings, or disable functionality using a low-privilege user account.
Potential impact on your site
04Site Impact
Unauthorized users can access confidential information, alter configurations, or cause service disruption from within your site.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the site; no special user interaction required.
Key dates
06Disclosure timeline
August 15, 2026
CVE published
