CVE-2026-8145: WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'processregistration' due to missing validation on the 'wholesalexregistrationrole' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an existing WordPress account?
No. An unauthenticated attacker can exploit the registration process without an existing account.
What level of access can an attacker obtain?
An attacker can register with any existing WholesaleX role. The issue is limited to roles that already exist in the WholesaleX configuration.
Is upgrading to version 2.3.8 sufficient to address the issue?
No. Version 2.3.8 only partially patched the vulnerability, and all versions through 3.0.8 are affected.