CVE-2026-27541: Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices <= 2.2.6

No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.

Description

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite allows Privilege Escalation. This issue affects Wholesale Suite: through 2.2.6.

Exploits & detection

Exploitrootdirective-sec/CVE-2026-27541-Analysis-Lab · github · ★ 0 · discovered

Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.

Timeline

Published: 05 Mar 2026
Last modified upstream: 05 Nov 2026

Sources & licenses

Vulnerability data

Wordfence Intelligence — record ↗ · Copyright Defiant Inc.

CVE / CVSS / CWE

NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.

Exploitation

CISA KEV (CC0) · EPSS by FIRST.org

References used for the analysis

wordfence Wholesale Suite <= 2.2.6 - Authenticated (Shop Manager) Privilege Escalation
https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-prices/vulnerability/wordpress-wholesale-suite-plugin-2-2-1-privilege-escalation-vulnerability?_s_id=cve

Analysis, summary and remediation

View JSON