All vulnerabilities
CVE-2026-8145

WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'

wpxpo WholesaleX – All-in-One B2B Solution with Wholesale Pricing
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.

Text from CVE List

Affected versions 1

  • WholesaleX – All-in-One B2B Solution with Wholesale Pricingaffected: all versions through 3.0.8CVE List

References 5