WholesaleX < 3.0.9 – Unauthenticated Account Activation and Administrator Approval Bypass | CVE 2026-111955

Description

The plugin does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.

Proof of Concept

The PoC will be displayed on November 02, 2026, to give users the time to update.

Affects Plugins

wholesalex

Fixed in 3.0.9

References

CVE

CVE-2026-111955

Classification

Type

AUTHBYPASS

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CWE-287

CVSS

6.5 (medium)

Miscellaneous

Original Researcher

Naoki Kawahigashi

Submitter

Naoki Kawahigashi

Verified

Yes

WPVDB ID

5fe1a629-8b05-4820-8cbe-4352c20930a3

Timeline

Publicly Published

2026-10-19 (about 2 days ago)

Added

2026-10-19 (about 1 day ago)

Last Updated

2026-10-19 (about 1 day ago)

Other

Published

Title

Published

2026-05-26

Title

Published

2026-06-22

Title

User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation

Published

2026-03-23

Title

Contest Gallery < 28.1.6 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion

Published

2014-08-01

Title

LayerSlider 4.6.1 - Remote Path Traversal File Access

Published

2014-08-01

Title

Portable phpMyAdmin 1.4.1 - Multiple Script Direct Request Authentication Bypass