The Wholesale for WooCommerce plugin permits an authenticated author to elevate their own role to administrator by sending a crafted request that sets the 'user_role_set' parameter to 'administrator'. The code sanitizes the value only with sanitize_text_field, performs no allowlist against allowed wholesale roles, and does not verify that the executor has privileges such as promote_users or manage_options, enabling a privilege escalation without additional checks.

All installations of the Wholesale for WooCommerce plugin by Saadiqbal, release versions up to and including 2.0.5 on WordPress, are affected. Users who are authors or higher and who can create or edit 'wwp_requests' posts—including those created via the wholesale registration form—can utilize the vulnerable request.

With a CVSS score of 8.8 the flaw is High severity. The EPSS score is less than 1%, indicating a low likelihood of observed exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with author-level access or higher, have access to a 'wwp_requests' post, and submit a POST request containing the correct 'request_user_role_nonce', after which the supplied 'administrator' role is directly added via WP_User::add_role, resulting in immediate access to all administrator capabilities.