WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation

Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture = 2.0.3.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions. id: CVE-2026-27542 info: name: WooCommerce Wholesale Le...

CVE-2026-27542-CVE-2026-27540-

🔴 Vulnerability Overview CVE-2026-27542 — Unauthenticated Privilege Escalation Field| Details ---|--- CVE ID| CVE-2026-27542 Severity| CRITICAL — CVSS v3.1 Score: 9.8 Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Component| WooCommerce Wholesale Lead Capture WWLC Plugin for...

CVE-2026-27541-Analysis-Lab

CVE-2026-27541 — WooCommerce Wholesale Prices Authenticated Privilege Escalation Lab Overview This project is a local Docker lab for analyzing and reproducing the behavior of CVE-2026-27541 in the WooCommerce Wholesale Prices / Wholesale Suite plugin by comparing vulnerable and patched builds...

CVE-2026-27540

🌐 Language / Dil 📌 Özet WooCommerce Wholesale Lead Capture WWLC — Kimlik doğrulamasız dosya yükleme → RCE | ---|--- Ürün| WooCommerce Wholesale Lead Capture — wwlc eklentisi Sürüm| ≤ 2.0.3.1 Fixed| 2.0.3.2+ — upload handler korumalı Auth| Unauthenticated Vektör|...

CVE-2026-8145

The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'processregistration' due to missing validation on the 'wholesalexregistrationrole' parameter. This...

EUVD-2026-102020

The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'processregistration' due to missing validation on the 'wholesalexregistrationrole' parameter. This...

VulnCheck KEV: CVE-2025-49924

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through = 2.2.4.2...

Exploit for CVE-2026-27540

🌐 Language / Dil --- 📌 Özet Woo...

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remot...

Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

On February 20th, 2026, a critical Unauthenticated Arbitrary File Upload vulnerability was publicly disclosed in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with an estimated 6,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload...

CVE-2026-85038: Missing Authorization

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

WordPress Wholesale Market plugin <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via 'rolerequired' Parameter vulnerability discovered by SEONGWON CHO - Chung-ang University in WordPress Plugin Wholesale Market versions = 2.2.2...

CVE-2026-14279

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

CVE-2026-14279 Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

CVE-2026-14279

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

CVE-2026-14279

CVE-2026-14279 affects the Wholesale Market plugin for WordPress. Vulnerable through version 2.2.2 via the ced_wholesale_request_send AJAX action. The root cause is flawed access control: the ced_wholesale_request_send_callback() only verifies a nonce and a positive user ID, then calls WP_User::a...

EUVD-2026-59594

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

CVE-2026-14279 Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

PT-2026-72876

Name of the Vulnerable Software and Affected Versions Wholesale Market versions prior to 2.2.3 Description The Wholesale Market plugin for WordPress allows authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator. This occurs when the site...

CVE-2026-14279: Improper Privilege Management

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...