CVE-2025-49924CWE-266

CVE-2025-49924

High · published October 22, 2025

CVSS v3.1
7.2
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

⚡ A privilege escalation flaw allows users access they shouldn’t have in Wholesale Suite for WooCommerce, potentially turning a regular customer into a super admin! 🔥 Think of it as a restaurant where a diner finds a way to sneak into the kitchen — suddenly, they can cook whatever they want without anyone stopping them! If exploited, this vulnerability could allow unauthorized users to elevate their privileges and gain access to sensitive administrative functionalities. An attacker could wreak havoc by changing prices, processing orders, or compromising customer data, putting your entire operation at risk.

Put simply

Think of it as a restaurant where a diner finds a way to sneak into the kitchen — suddenly, they can cook whatever they want without anyone stopping them! The incorrect privilege assignment in the Wholesale Suite allows users to escalate their privileges beyond what they should have, leading to unauthorized access to critical system features.

What to do

If exploited, this vulnerability could allow unauthorized users to elevate their privileges and gain access to sensitive administrative functionalities. An attacker could wreak havoc by changing prices, processing orders, or compromising customer data, putting your entire operation at risk. To secure your installation, update Wholesale Suite to version 2.2.4.3 or later immediately. Review user roles and permissions carefully to ensure no unauthorized users have access to sensitive functions. You've got this! Follow these steps, and you’ll have your WooCommerce shop locked down in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-10-22T19:15Z
References (1)
EPSS history
Timeline
  • 22 OCT 14:32Z
    WordPress Wholesale Suite plugin <= 2.2.4.2 - Privilege Escalation vulnerability
    cvelistv5