Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cedcommerce | Wholesale Market | up to 2.2.2 | — | No fix listed | CNA |
- Wholesale Market Vendorcedcommerce Affected up to 2.2.2 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-14279
- 2026-10-03 Alias added: GHSA-wv24-4cw2-5gxg
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/abd59d7a-e7f6-440d-9c2a-00266c0dcbff?source=cve
- https://plugins.trac.wordpress.org/browser/wholesale-market/tags/2.2.2/addons/wholesale-request/include/class-wholesale-user-register-addon.php#L141
- https://plugins.trac.wordpress.org/browser/wholesale-market/tags/2.2.2/addons/wholesale-request/include/class-wholesale-user-register-addon.php#L153
- https://plugins.trac.wordpress.org/browser/wholesale-market/tags/2.2.2/addons/wholesale-request/include/class-wholesale-user-register-addon.php#L276
- https://plugins.trac.wordpress.org/browser/wholesale-market/tags/2.2.2/addons/wholesale-request/include/class-wholesale-user-register-addon.php#L30
More cedcommerce vulnerabilities
- TI-2022-03936 Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File Download CVSS 3.1CRITICAL 9.8
- TI-2022-03754 Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download CVSS 3.1HIGH 7.5
- TI-2022-03996 Wholesale Market <= 2.2.2 - Settings Update via CSRF CVSS 3.1MEDIUM 6.5
- TI-2022-03755 SMSA Shipping for WooCommerce < 1.0.5 - Subscriber+ Arbitrary File Download CVSS 3.1MEDIUM 6.5
- TI-2022-03756 Wholesale Market for WooCommerce < 1.0.8 - Admin+ Arbitrary File Download CVSS 3.1MEDIUM 4.9
- TI-2022-03757 Wholesale Market for WooCommerce < 2.0.0 - Admin+ Arbitrary Log Download CVSS 3.1LOW 2.7
Sources
- CVE-2026-14279 · CVE Program
- CVE-2026-14279 · NVD
- FIRST EPSS
- GHSA-wv24-4cw2-5gxg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences