The vulnerability allows an attacker who is not logged in to register as any existing role within the WholesaleX plugin through the process_registration function. Because the wholesalex_registration_role parameter is not validated, an unauthenticated user can obtain the privileges of other users, granting them potentially sensitive access to wholesale configuration and pricing.

All versions of the WholesaleX WordPress plugin up to and including 3.0.8 are affected. The plugin is provided by wpxpo:WholesaleX and includes the All‑in‑One B2B and Wholesale Pricing solution. A partial fix was applied in version 2.3.8, but the issue remains in later releases.

The vulnerability scores a CVSS of 5.4, indicating moderate impact, and an EPSS score of less than 1%, showing a low probability of exploitation as of the current assessment. The flaw is not listed in the CISA KEV catalog. Attackers can exploit it by issuing unauthenticated HTTP requests to the process_registration endpoint and supplying an arbitrary wholesalex_registration_role value, thereby elevating their privileges without authentication. No additional prerequisites or network exposure beyond access to the WordPress site are required.