CVE-2026-27541-Analysis-Lab

CVE-2026-27541 — Laboratorio di Escalation dei Privilegi Autenticata in WooCommerce Wholesale Prices Panoramica Questo progetto è un laboratorio Docker locale per analizzare e riprodurre il comportamento di CVE-2026-27541 nel plugin WooCommerce Wholesale Prices / Wholesale Suite , confrontando le...

WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation

Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture = 2.0.3.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions. id: CVE-2026-27542 info: name: WooCommerce Wholesale Le...

CVE-2026-27542-CVE-2026-27540-

🔴 Panoramica delle Vulnerabilità CVE-2026-27542 — Escalation dei Privilegi non Autenticata Descrizione: Il plugin WooCommerce Wholesale Lead Capture per WordPress è vulnerabile all'Escalation dei Privilegi non Autenticata in tutte le versioni interessate note. La vulnerabilità risiede nel gestore...

WordPress Wholesale Market plugin <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via 'rolerequired' Parameter vulnerability discovered by SEONGWON CHO - Chung-ang University in WordPress Plugin Wholesale Market versions = 2.2.2...

CVE-2026-14279

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

CVE-2026-14279 Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

CVE-2026-14279

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

CVE-2026-14279

CVE-2026-14279 affects the Wholesale Market plugin for WordPress. Vulnerable through version 2.2.2 via the ced_wholesale_request_send AJAX action. The root cause is flawed access control: the ced_wholesale_request_send_callback() only verifies a nonce and a positive user ID, then calls WP_User::a...

CVE-2026-14279 Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

EUVD-2026-59594

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

PT-2026-72876

Name of the Vulnerable Software and Affected Versions Wholesale Market versions prior to 2.2.3 Description The Wholesale Market plugin for WordPress allows authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator. This occurs when the site...

CVE-2026-12144

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...

CVE-2026-12144

CVE-2026-12144 affects the Wholesale for WooCommerce plugin for WordPress (all versions up to and including 2.0.5). The root cause is in save_requests_meta(): the user_role_set POST parameter is sanitized only with sanitize_text_field(), then passed directly to WP_User::add_role() without an allo...

EUVD-2026-50097

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...

EUVD-2026-39683

Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale = 1.0.27 versions...

CVE-2026-9241

The FOX – Currency Switcher Professional for WooCommerce WordPress plugin (up to version 1.4.6) is affected by an Authorization Bypass through a user-controlled key. The flaw resides in get_value() in classes/fixed/fixed_user_role.php, which trusts the attacker-controlled $_REQUEST['wooc_order_us...

CVE-2026-4479

The WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress WholeSale Products Dynamic Pricing Management WooCommerce plugin <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Plugin Settings vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin WholeSale Products Dynamic Pricing Management WooCommerce versions = 1.2...

WordPress plugin WholeSale Products Dynamic Pricing Management 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

CVE-2026-27542

Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Privilege Escalation.This issue affects Woocommerce Wholesale Lead Capture: from n/a through = 2.0.3.1...