Woocommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation
2026-02-20 00:00
Teemu SaarentausStrategic Overview
StatusPatched in 2.0.3.2
Affected PluginWholesale Lead Capture Plugin for WooCommerce
Affected Version
<= 2.0.3.1CVSS9.8Critical
CVE
CVE-2026-27542Vulnerability Overview
The Wholesale Lead Capture Plugin for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.3.1. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
Technical Analysis
REMEDIATION: Update to version 2.0.3.2, or a newer patched version --- IDENTIFIER: CWE-269 (Improper Privilege Management) The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C