The plugin contains an incorrect privilege assignment flaw that can enable an attacker lacking full rights to acquire administrator privileges on a WordPress site. Elevating to administrator level allows the attacker to change site content, modify settings, or compromise other security controls, resulting in a full takeover of the installation. The weakness is classified as a privilege management error, preventing proper role enforcement.

All WordPress installations that employ the Wholesale Suite plugin authored by Josh Kohlbach and are at version 2.2.6 or earlier are affected. Versions newer than 2.2.6 have already addressed the flaw and are considered safe.

The CVSS score of 7.2 marks the vulnerability as moderate‑to‑high severity, yet the EPSS score of less than 1% indicates an overall low probability of exploitation under current observation. The flaw is not listed in the CISA KEV catalog, implying no known widespread active exploitation. The primary attack vector is inferred to be a logged‑in WordPress user with limited access who interacts with the plugin’s functionality, though the precise exploitation method is not documented in the available data.