{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:10:18.683880Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T13:10:27.124Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WholesaleX \u2013 All-in-One B2B Solution with Wholesale Pricing",
          "vendor": "wpxpo",
          "versions": [
            {
              "lessThanOrEqual": "3.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ronnachai Chaipha (rxnr)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WholesaleX \u2013 B2B \u0026 Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the \u0027process_registration\u0027 due to missing validation on the \u0027wholesalex_registration_role\u0027 parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T11:34:32.426Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b9464c-dcc4-4ae8-816f-1572f84dfe08?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wholesalex/trunk/includes/menu/class-wholesalex-registration.php#L1327"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wholesalex/tags/2.3.7/includes/menu/class-wholesalex-registration.php#L1327"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3529605/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3703929/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-07T23:47:08.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-14T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WholesaleX \u003c= 3.0.8 - Unauthenticated Limited Privilege Escalation via \u0027process_registration\u0027"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-8145",
    "datePublished": "2026-10-15T11:34:32.426Z",
    "dateReserved": "2026-05-07T23:24:29.096Z",
    "dateUpdated": "2026-10-15T13:10:27.124Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}