Privilege Escalation in Wholesale Market WordPress Plugin

hello@craftedsignal.io — Sat, 15 Aug 2026 08:17:10 +0000

The Wholesale Market plugin for WordPress, in versions up to and including 2.2.2, is susceptible to a privilege escalation vulnerability within the ced_wholesale_request_send AJAX handler. The vulnerability exists because the ced_wholesale_request_send_callback function performs inadequate security validation. Specifically, it only verifies a nonce that is exposed to any authenticated user via wp_localize_script and confirms a positive user ID. Crucially, the function fails to validate the role_required POST parameter against a secure allowlist, instead passing it directly to the WP_User::add_role() function. If the 'Assigning requested role directly' option is enabled in the plugin configuration, any authenticated attacker with at least Subscriber-level access can manipulate this parameter to assign themselves the Administrator role. This issue represents a significant risk to WordPress installations utilizing this plugin for B2B wholesale management.

Wholesale Market - CraftedSignal Threat Feed

Privilege Escalation in Wholesale Market WordPress Plugin