The Wholesale Market WordPress plugin is vulnerable to privilege escalation in versions up to and including 2.2.2. The ced_wholesale_request_send AJAX handler verifies only a nonce and that the caller is logged in, then calls WP_User::add_role() using the client‑supplied role_required parameter without restricting it to the plugin’s wholesale role list. An authenticated user with Subscriber-level access or higher can therefore inject the value Administrator for role_required and, if the site administrator has enabled the ‘Assigning requested role directly’ option, elevate their privileges to Administrator. This results in full site control and any of the capabilities that come with that role.

The affected product is CedCommerce Wholesale Market, a WordPress plugin. Versions 2.2.2 and earlier are vulnerable. The issue exists on WordPress sites that have the plugin installed and upgraded to an affected version.

The CVSS score of 8.8 indicates a high severity flaw, but the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The flaw is not referenced in the CISA KEV catalog. The required conditions for exploitation are: (1) the site must be running a vulnerable version of the plugin, (2) the user must be authenticated at least at the Subscriber level, and (3) the ‘Assigning requested role directly’ setting must be enabled. Attackers can send an AJAX request to the ced_wholesale_request_send endpoint with a crafted role_required value and trigger the privilege escalation remotely over an HTTP connection.