PT-2026-114909 · Wpxpo · Wholesalex – All-In-One B2B Solution With Wholesale Pricing

Ronnachai Chaipha

·

CVE-2026-8145

·

Published

2026-10-15

·

Updated

2026-10-15

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process registration' due to missing validation on the 'wholesalex registration role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.

Fix

Improper Privilege Management

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-8145

Affected Products

Wholesalex – All-In-One B2B Solution With Wholesale Pricing