WordPress Plugin Vulnerabilities

Woocommerce Wholesale Lead Capture < 2.0.3.2 - Unauthenticated Privilege Escalation

Description

The Wholesale Lead Capture Plugin for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.3.1. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
woocommerce-wholesale-lead-capture
Fixed in 2.0.3.2

References

CVE
CVE-2026-27542
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/033e8326-38ed-4d36-8a29-06f9c8a5e808

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Teemu Saarentaus
Verified
No
WPVDB ID
6c263002-7d06-412c-81e3-393a7321e85f

Timeline

Publicly Published
2026-02-20 (about 6 months ago)
Added
2026-02-25 (about 6 months ago)
Last Updated
2026-09-09 (about 6 days ago)

Other

Published
Title
Published
2026-01-21
Title
Lawyer Directory < 1.3.4 - Subscriber+ Privilege Escalation
Published
2026-08-21
Title
RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator
Published
2025-05-20
Title
Spreadsheet Price Changer for WooCommerce and WP E-commerce <= 2.4.37 - Unauthenticated Privilege Escalation
Published
2025-04-17
Title
Real Estate 7 < 3.5.3 - Unauthenticated Privilege Escalation
Published
2023-08-08
Title
Biometric Login for WooCommerce < 1.0.4 - Unauthenticated Privilege Escalation