Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter
high
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the fr...
- CVSS:
- 8.8
- Affected:
- up to 2.2.2
- Fix:
- No patched version reported
- Disclosed:
- Aug 14, 2026
CVE-2026-14279 on NVD →
Wholesale Market <= 2.2.0 - Information Disclosure via Unauthenticated Arbitrary File Download
high
The Wholesale Market plugin for WordPress is vulnerable to arbitrary file download due to missing file name validation via the ced_cwsm_log_download parameter in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to download arbitrary files on the affected site's server leading t...
- CVSS:
- 7.5
- Affected:
- up to 2.2.0
- Fixed in:
- 2.2.1
- Disclosed:
- Dec 12, 2022
CVE-2022-4298 on NVD →
Wholesale Market for WooCommerce <= 2.0.0 & Wholesale Market <= 2.2.1 - Cross-Site Request Forgery
medium
Multiple plugins for WordPress are vulnerable to Cross-Site Request Forgery in various versions. This is due to missing or incorrect nonce validation on the 'wholesale_market' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site ad...
- CVSS:
- 4.3
- Affected:
- up to 2.2.1
- Fixed in:
- 2.2.2
- Disclosed:
- Dec 8, 2022
CVE-2022-4363 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database