Privilege Escalation Vulnerability in Wholesale Market Plugin for WordPress

CVE-2026-14279

What is CVE-2026-14279?

The Wholesale Market plugin for WordPress contains a vulnerability that allows authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator. This occurs through the ced_wholesale_request_send AJAX action, where the callback function only verifies a nonce and a positive user ID, without adequately restricting the caller-supplied role. Consequently, if the site administrator has the 'Assigning requested role directly' option enabled, attackers could exploit this weakness to gain elevated permissions. It is essential for users of this plugin to update to the latest version to mitigate this risk.

References