CVE-2026-111955: CWE-287 Improper Authentication in WholesaleX

CVE-2026-111955 describes an improper authentication vulnerability (CWE-287) in the WholesaleX WordPress plugin prior to version 3.0.9. The flaw arises because the plugin fails to check whether a stored account confirmation code exists before comparing it with a code provided in a request. This logic error enables unauthenticated attackers to activate pending user accounts without administrator approval, potentially allowing unauthorized access to the system.

An attacker can activate pending accounts without administrator approval, bypassing intended access controls. This could lead to unauthorized user logins and potential misuse of the activated accounts. No information about active exploitation or additional impacts is provided.

Upgrade WholesaleX to version 3.0.9 or later, where this vulnerability is fixed. Since the vulnerability affects versions prior to 3.0.9, applying the official update is the recommended remediation. No vendor advisory content is provided, so patch status is inferred from the version information.