Junglewise Threat Intelligence

CVE-2026-12144: Wholesale for WooCommerce privilege escalation in save_requests_meta

CVE-2026-12144 · Severity: high · CVSS 8.8 · Published 2026-07-29

Vendors: Saad Iqbal.

Executive brief

The Wholesale for WooCommerce plugin for WordPress, which manages wholesale pricing and registration, contains a security flaw that allows users with low-level access to grant themselves administrative control. By exploiting this vulnerability, an attacker could take over the entire website, access sensitive customer data, or disrupt business operations. This issue affects all versions of the plugin up to 2.0.5.

Technical details

The Wholesale for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a lack of capability checks and role validation in the `save_requests_meta()` function. The function processes the `user_role_set` POST parameter using only `sanitize_text_field()` before passing it to `WP_User::add_role()`, failing to verify if the current user has the `promote_users` or `manage_options` capabilities. Authenticated attackers with author-level access (or those who have authored a `wwp_requests` post) can obtain the necessary nonce from the post edit screen and submit a crafted request to assign themselves the 'administrator' role. This vulnerability is fixed in versions following 2.0.5.

Affected products

  • saadiqbal Wholesale for WooCommerce up to, and including, 2.0.5

Timeline

  • 2026-07-29: disclosed
  • 2026-07-29: advisory

References