The vulnerability in WholesaleX occurs because the plugin does not verify that a stored account confirmation code is present before comparing it to a supplied code in an activation request. This omission enables an unauthenticated attacker to activate pending user accounts without possessing valid credentials, effectively bypassing the administrator’s review process required before login. The result is an ability for an attacker to create and activate accounts that may then be used to gain unauthorized access to the WordPress site.

All installations of the WholesaleX WordPress plugin prior to version 3.0.9 are affected. The vendor is identified only as "WholesaleX"; no additional vendor details are available. Sites using any older version of this plugin should be considered at risk.

The reported issue is a direct access control flaw (CWE‑284). Attackers can exploit it by sending crafted activation requests to the plugin’s endpoint without needing prior authentication. While no CVSS score is provided, the impact is significant because it permits account creation without administrator oversight. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploited attacks have not been documented to date, but the potential for abuse remains high for sites that rely on the default activation workflow.