Skip to content
Sign in
6.5 Medium

CVE-2026-111955 The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before…

Description

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.

Affected products and versions

Product Affected versions Fixed in
WholesaleX 3.0 earliest → < 3.0.9 3.0.9

Other CVEs of WholesaleX

The 2 CVEs of WholesaleX →
CVE-2026-111956 The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly… 5.9 Medium
Track this CVE