Description

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T07:16:19.120Z",
  "pubdate": "2026-08-15T07:16:19.120Z",
  "executiveSummary": "The Wholesale Market plugin for WordPress in versions up to, and including, 2.2.2 is susceptible to an unauthenticated or low-privileged privilege escalation vulnerability. The flaw allows authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator.\nThe vulnerability stems from improper input validation and inadequate authorization checks within the plugin's AJAX action handling mechanism. Specifically, the ced_wholesale_request_send_callback() handler relies solely on a publicly exposed nonce and a check for a positive user ID, failing to enforce an allowlist on the user-supplied role_required POST parameter.\nAn attacker possessing low-level credentials can exploit this issue by supplying arbitrary administrative role assignments when the site administrator has enabled the 'Assigning requested role directly' option.\nSuccessful exploitation compromises the entire WordPress installation, granting the attacker full administrative control, arbitrary code execution capabilities, and complete access to underlying database and server resources.",
  "technicalDetails": "The vulnerability resides in the Wholesale Market plugin for WordPress, specifically affecting versions up to, and including, 2.2.2. The vulnerable component is the ced_wholesale_request_send AJAX action handled by the ced_wholesale_request_send_callback() function.\nThe root cause of the vulnerability is a combination of weak authorization controls and absent input sanitization. During execution, the ced_wholesale_request_send_callback() function validates only two conditions: the presence and validity of a nonce, and that the calling user possesses a positive user ID. The nonce itself provides insufficient protection as it is exposed to any authenticated user via wp_localize_script on the frontend.\nUpon passing these rudimentary checks, the handler directly processes the client-supplied role_required POST parameter without restricting its value against an allowlist of legitimate wholesale roles. The application subsequently invokes the WP_User::add_role() method using this unvalidated, attacker-supplied role parameter.\nThe attack flow proceeds as follows: 1) An attacker authenticates with minimal privileges, such as the Subscriber role. 2) The attacker extracts the exposed nonce from the frontend script localization data. 3) The attacker crafts an HTTP POST request targeting the admin-ajax.php endpoint with the action parameter set to ced_wholesale_request_send, including the harvested nonce and setting the role_required parameter to 'administrator'. 4) The server processes the request via ced_wholesale_request_send_callback(), validating the nonce and user ID while ignoring the malicious role assignment. 5) The application executes WP_User::add_role() with the 'administrator' role, immediately elevating the attacker's privilege level.\nExploitation requires the target WordPress site to have the 'Assigning requested role directly' configuration option enabled. The attack vector requires network exposure via the standard WordPress AJAX interface and authenticated access at the Subscriber level or above."
}