CVE-2026-12144: Wholesale for WooCommerce plugin for WordPress
CVE-2026-12144 analysis covering impact, affected products, versions, remediation, and cross-checked defender guidance.
CVE-2026-12144 is a vulnerability published by NVD on 7/29/2026.
What happened
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the `save_requests_meta()` function applying only `sanitize_text_field()` to the `user_role_set` POST parameter before passing it directly to `WP_User::add_role()`, with no allowlist validation against permitted wholesale roles and no capability check such as `current_user_can('promote_users')` or `current_user_can('manage_options')`. This makes it possible for authenticated attackers with author-level access and above to escalate their privileges to administrator by supplying `administrator` as the `user_role_set` value in a crafted request. The function is gated only by a nonce (`request_user_role_nonce`) that is rendered in the meta box on the `wwp_requests` post edit screen; because the post type is registered with `capability_type => 'post'`, any author-level user who has authored a `wwp_requests` post — such as one created via the wholesale registration form — can access this nonce and submit the role-assignment request.
Affected products and versions
- NVD has not published a normalized affected-product configuration yet.
Severity and weakness
CVSS: HIGH 8.8. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Weaknesses: CWE-269.
Known exploitation
No CISA KEV entry is currently attached to the NVD record.
What defenders should do
- Identify whether the affected product and version range exists in production.
- Review vendor advisories and release notes before change windows.
- Patch, upgrade, disable the vulnerable component, or apply vendor mitigations.
- Verify the running version after deployment, not only the package inventory.
Official and supporting references
- No vendor advisory tagged by NVD at draft time.