Live › vulnerability › CVE-2026-111955
Go to dashboardThe WholesaleX WordPress plugin before 3.0.9 compares a supplied confirmation code against a stored one without first checking that the stored code exists. An unauthenticated visitor can therefore activate pending accounts and log in without administrator approval.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the WholesaleX plugin before 3.0.9 that use its account approval flow for wholesale registrations. Sites without the plugin, or without administrator approval of registrations, can skip it.
No product ranges from the sources yet.
wp plugin get wholesalex --field=version3.0.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.
This page as .md · .json · in your agent: get_signal("CVE-2026-111955")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.