The vulnerability is an incorrect privilege assignment flaw in the Josh Kohlbach Wholesale Suite plugin for WordPress. An attacker who should not possess advanced rights can exploit this defect to gain elevated privileges, potentially becoming an administrator of the WordPress site. With administrative access, the attacker could read, modify, or delete content, alter site settings, or compromise security controls. The weakness is classified as CWE-266, indicating an error in privileged role management.

WordPress installations that include the Wholesale Suite plugin authored by Josh Kohlbach, with any version up to and including 2.2.6. The precise earliest version that contains the flaw is not documented, so all releases through 2.2.6 are considered vulnerable.

The CVSS score of 7.1 suggests a moderate to high potential impact, while the EPSS score of less than 1% indicates a very low probability of exploitation under current knowledge. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread active exploitation. Because the flaw involves privilege escalation, the primary attack vector is likely through a logged‑in user with limited rights interacting with the plugin’s functionality, though the exact method is not detailed in the available information.