CVE-2026-8145

5.4 Moyenne

Publiée le 15/10/2026 à 14:16 · Modifiée le 15/10/2026 à 16:45 · Analyse NVD reportée · Source : security@wordfence.com

Description

The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.

Traduire en français

Produits concernés

wpxpo WholesaleX – All-in-One B2B Solution with Wholesale Pricing

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	security@wordfence.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-269

Références

https://plugins.trac.wordpress.org/browser/wholesalex/tags/2.3.7/includes/menu/class-wholesalex-registration.php#L1327
https://plugins.trac.wordpress.org/browser/wholesalex/trunk/includes/menu/class-wholesalex-registration.php#L1327
https://plugins.trac.wordpress.org/changeset/3529605/
https://plugins.trac.wordpress.org/changeset/3703929/
https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b9464c-dcc4-4ae8-816f-1572f84dfe08?source=cve

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories