CVE-2026-12144: Wholesale WooCommerce Privilege Escalation

CVE-2026-12144 Overview

CVE-2026-12144 is a privilege escalation vulnerability in the Wholesale for WooCommerce plugin for WordPress, affecting all versions up to and including 2.0.5. The flaw resides in the save_requests_meta() function within class-wwp-wholesale-requests.php, which fails to validate the user_role_set POST parameter against an allowlist and omits capability checks. Authenticated attackers with author-level access or higher can escalate to administrator by submitting administrator as the role value in a crafted request. The vulnerability is classified under [CWE-269: Improper Privilege Management].

Critical Impact
Authenticated author-level users can escalate to administrator, leading to complete WordPress site takeover.

Affected Products

Wholesale for WooCommerce plugin (woo-wholesale-pricing) versions ≤ 2.0.5
WordPress installations using the affected plugin
WooCommerce sites accepting wholesale registration requests

Discovery Timeline

2026-07-29 - CVE-2026-12144 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-12144

Vulnerability Analysis

The Wholesale for WooCommerce plugin registers a custom post type named wwp_requests with capability_type => 'post'. Any user who authored a wwp_requests post, including one created through the public wholesale registration form, can access the meta box on the post edit screen. That meta box renders a valid request_user_role_nonce value, which is the only server-side gate protecting the role assignment handler.

The save_requests_meta() function processes the submitted user_role_set value using sanitize_text_field() and passes the result directly to WP_User::add_role(). No allowlist restricts the role to permitted wholesale roles, and no capability check such as current_user_can('promote_users') or current_user_can('manage_options') is performed. An attacker with author-level access can submit administrator and gain full administrative privileges.

Root Cause

The root cause is missing authorization: the plugin relies on a nonce for CSRF protection but conflates nonce validation with authorization. Because the nonce is exposed to any author of a wwp_requests post, and because the target role is neither validated nor scoped, the handler accepts arbitrary WordPress role names including administrator.

Attack Vector

An attacker registers or obtains an author-level account and creates a wwp_requests post through the wholesale registration flow. The attacker then loads the post edit screen, harvests the request_user_role_nonce, and submits a POST request setting user_role_set=administrator. The handler adds the administrator role to the attacker's account. See the Wordfence Vulnerability Analysis and the affected code in the WordPress Plugin Repository for technical details.

Detection Methods for CVE-2026-12144

Indicators of Compromise

Unexpected administrator role assignments in the wp_usermeta table for users originally registered as author or contributor
POST requests to wwp_requests post edit endpoints containing user_role_set=administrator
New or modified wwp_requests post entries followed by role changes on the authoring user account
Access log entries showing author-level accounts reaching /wp-admin/post.php for the wwp_requests post type

Detection Strategies

Audit WordPress user roles and compare current role assignments against the expected baseline for non-administrator accounts
Monitor plugin file integrity for class-wwp-wholesale-requests.php and alert on unauthorized changes
Review WooCommerce and WordPress audit logs for role escalation events tied to the wholesale request workflow

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform to correlate authentication events with role changes
Alert on any assignment of the administrator role outside of established administrative workflows
Track creation of wwp_requests posts followed within a short window by role modification requests from the same session

How to Mitigate CVE-2026-12144

Immediate Actions Required

Update the Wholesale for WooCommerce plugin to the version containing the fix referenced in the WordPress Plugin Changeset
Audit all WordPress users for unexpected administrator privileges and revoke unauthorized role assignments
Rotate credentials for any account showing suspicious role escalation activity
Review recent wwp_requests submissions for signs of malicious registration

Patch Information

The vendor released a fix tracked in changeset 3621257 for the woo-wholesale-pricing plugin. The patch enforces role allowlist validation and adds capability checks before invoking WP_User::add_role(). Site operators should upgrade beyond version 2.0.5 to remediate the flaw.

Workarounds

Disable or uninstall the Wholesale for WooCommerce plugin until patched versions are deployed
Restrict author-level and higher account creation to trusted users only, and disable public wholesale registration temporarily
Deploy a web application firewall rule blocking POST parameters containing user_role_set=administrator on wwp_requests endpoints

bash

# Example WP-CLI audit to list users holding the administrator role
wp user list --role=administrator --fields=ID,user_login,user_registered,user_email