The Wholesale Suite plugin for WooCommerce contains an incorrect privilege assignment flaw that permits users with limited access to elevate their privileges. This deficiency allows an attacker who has a non‑privileged account to gain higher, potentially administrative rights, compromising the integrity and confidentiality of the hosted website. The weakness is categorized as CWE‑266, insecure authorization.

Any installation of Wholesale Suite version 2.2.4.2 or earlier, including releases without a specified version number, is affected. The plugin is used in WordPress sites that integrate WooCommerce wholesale pricing functionality.

The CVSS score of 7.2 indicates a high severity. The EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user with non‑privileged access who exploits the flawed privilege assignment logic to obtain administrative capabilities. The description does not provide explicit prerequisites, but it is inferred that the attacker must log in to the site first. Once escalated, the attacker could modify wholesale pricing, access sensitive order data, or alter site configuration.