CVE-2026-111955
WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass
Unknown WholesaleX
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.0.9WholesaleXCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.
Text from CVE List
Affected versions 1
- WholesaleXaffected: all versions before 3.0.9CVE List