CVE-2026-111955: WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass
Published Oct 21, 2026
·Updated
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.
Affected Software
1 affected component
WholesaleX WholesaleX WordPress plugin<3.0.9
Event History
Oct 21, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Which accounts can be activated without administrator approval?
Pending accounts are affected. An unauthenticated user can activate such an account and bypass the administrator approval requirement before login.
2
Does exploitation require an existing confirmation code?
No. The issue occurs because the plugin does not verify that a stored account confirmation code is set before comparing it with a code supplied in a request.
3
Which plugin versions are affected?
WholesaleX versions before 3.0.9 are affected.