CVE-2026-8145— WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'
Quick assessment
Affected
wpxpo WholesaleX – All-in-One B2B Solution with Wholesale Pricing
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 上的 WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices 插件存在权限提升漏洞，影响所有 3.0.8 及更早版本。该漏洞源于对 'wholesalex_registration_role' 参数缺乏验证，导致攻击者可通过 'process_registration' 功能实现有限权限的提升。这使得未经身份验证的攻击者能够以任意已存在的 WholesaleX 角色进行注册。该漏洞已在版本 2.3.8 中
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| wpxpo | WholesaleX – All-in-One B2B Solution with Wholesale Pricing | ≤ 3.0.8 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-8145
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'
Source: CVE Program / CVE List V5
Vulnerability Description
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| wpxpo | WholesaleX – All-in-One B2B Solution with Wholesale Pricing | 0 ~ 3.0.8 | - |
|
II. Public POCs for CVE-2026-8145
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-8145
请登录查看更多情报信息。
Other References for CVE-2026-8145 (3)
IV. Related Vulnerabilities
Same vendor: wpxpo
-
CVE-2026-96840
Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored -
CVE-2026-5158
PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross- -
CVE-2026-17161
WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cro -
CVE-2026-17162
WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cro -
CVE-2026-15100
Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contri
Same weakness: CWE-269
-
CVE-2026-104755
WP Compress <= 7.25.00 - Unauthenticated Privilege Escalatio -
CVE-2026-85659
PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege -
CVE-2026-109447
User Profile Builder <= 4.0.3 - Unauthenticated Privilege Es -
CVE-2026-89079
Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalati -
CVE-2026-104798
My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation
V. Comments for CVE-2026-8145
No comments yet