Is CVE-2026-12144 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12144 being exploited in the wild.

How severe is CVE-2026-12144?

High severity, with a CVSS score of 8.8, published 29 July 2026.

Which products and versions are affected?

Saad Iqbal Wholesale for WooCommerce up to, and including, 2.0.5.

Is there a fix for CVE-2026-12144?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12144 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12144?

Check whether you run Saad Iqbal Wholesale for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12144: Wholesale for WooCommerce privilege escalation in save_requests_meta

CVE-2026-12144 · Severity: high · CVSS 8.8 · Published 2026-07-29

The Wholesale for WooCommerce plugin for WordPress, which manages wholesale pricing and registration, contains a security flaw that allows users with low-level access to grant themselves administrative control. By exploiting this vulnerability, an attacker could take over the entire website, access sensitive customer data, or disrupt business operations. This issue affects all versions of the plugin up to 2.0.5.

Vendors: Saad Iqbal.

Quick answers

Is CVE-2026-12144 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12144 being exploited in the wild.
How severe is CVE-2026-12144?: High severity, with a CVSS score of 8.8, published 29 July 2026.
Which products and versions are affected?: Saad Iqbal Wholesale for WooCommerce up to, and including, 2.0.5.
Is there a fix for CVE-2026-12144?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12144 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12144?: Check whether you run Saad Iqbal Wholesale for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Wholesale for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a lack of capability checks and role validation in the `save_requests_meta()` function. The function processes the `user_role_set` POST parameter using only `sanitize_text_field()` before passing it to `WP_User::add_role()`, failing to verify if the current user has the `promote_users` or `manage_options` capabilities. Authenticated attackers with author-level access (or those who have authored a `wwp_requests` post) can obtain the necessary nonce from the post edit screen and submit a crafted request to assign themselves the 'administrator' role. This vulnerability is fixed in versions following 2.0.5.

Affected products

saadiqbal Wholesale for WooCommerce up to, and including, 2.0.5

Timeline

2026-07-29: disclosed
2026-07-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.