CVE-2026-14279 cedcommerce CVE debrief

Who should care

WordPress site administrators using the Wholesale Market plugin, security teams monitoring for potential privilege escalation attacks, and operators of affected systems should review and adjust their security settings to prevent exploitation.

Technical summary

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles.

Defensive priority

High priority due to high CVSS score of 8.8 and potential for privilege escalation.

Recommended defensive actions

• Inventory and verify Wholesale Market plugin version
• Restrict role assignment to allowlisted roles
• Monitor for suspicious role elevation attempts
• Apply vendor patch or update to fixed version
• Review and adjust 'Assigning requested role directly' option
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Wholesale Market plugin for WordPress has a vulnerability allowing privilege escalation up to version 2.2.2. Evidence from Wordfence and NVD indicates vulnerability in Wholesale Market plugin versions up to 2.2.2. Limited information available on affected scope and vendor remediation. The vulnerability exists in the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option. Defenders should verify Wholesale Market plugin versions, review role assignment settings, and monitor for suspicious role elevation attempts.

Official resources