Account Activation Bypass in WholesaleX WordPress Plugin
CVE-2026-111955
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 21 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111955?
The WholesaleX WordPress plugin prior to version 3.0.9 exhibits a flaw wherein it fails to validate that a stored account confirmation code exists before performing a match with the supplied code. This vulnerability permits unauthorized users to activate pending accounts, effectively circumventing the administrator's approval process and allowing immediate access to the system, which could lead to potential unauthorized actions.
Affected Version(s)
WholesaleX 0 < 3.0.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.