Vulnerability in wpxpo WholesaleX – All-in-One B2B Solution with Wholesale Pricing

[ Description ]Official description

The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• plugins.trac.wordpress.org/browser/wholesalex/tags/2.3.7/includes/menu/class-wholesalex…
• plugins.trac.wordpress.org/browser/wholesalex/trunk/includes/menu/class-wholesalex-regi…
• plugins.trac.wordpress.org/changeset/3529605
• plugins.trac.wordpress.org/changeset/3703929
• www.wordfence.com/threat-intel/vulnerabilities/id/d3b9464c-dcc4-4ae8-816f-1572f84dfe08