CVE-2026-12144 is a privilege escalation vulnerability in the Wholesale for WooCommerce WordPress plugin affecting versions up to 2.0.5. The save_requests_meta() function applies only sanitize_text_field() to the user_role_set POST parameter before passing it to WP_User::add_role() without validating the role against an allowlist or checking user capabilities such as promote_users or manage_options. Because the nonce protecting this action is accessible to author-level users who have authored wwp_requests posts, attackers with author privileges can escalate to administrator by submitting a crafted request with user_role_set set to 'administrator'.

Successful exploitation allows an authenticated user with author-level access or higher to escalate their privileges to administrator, gaining full control over the WordPress site. This can lead to complete site compromise, including data theft, site defacement, or further malicious activity. The CVSS 3.1 score is 8.8 (High), reflecting the network attack vector, low attack complexity, required privileges of low (author), no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level user capabilities to prevent access to wwp_requests post types or disable the Wholesale for WooCommerce plugin if possible. Monitor for updates from the vendor and apply patches promptly once released.