The Wholesale Market plugin for WordPress versions up to and including 2.2.2 contains a privilege escalation vulnerability (CWE-269) via the ced_wholesale_request_send AJAX action. The handler ced_wholesale_request_send_callback() verifies a nonce exposed to any authenticated user and checks for a positive user ID but then calls WP_User::add_role() with a client-supplied role_required POST parameter without restricting it to an allowlist of wholesale roles. If the site administrator has enabled the 'Assigning requested role directly' option, this allows authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator.

An attacker with authenticated access at Subscriber level or above can escalate their privileges to Administrator, potentially gaining full control over the WordPress site. This includes the ability to modify site content, install plugins or themes, and manage other users, leading to a complete compromise of confidentiality, integrity, and availability of the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the 'Assigning requested role directly' option to prevent exploitation. Additionally, restrict authenticated user access and monitor for suspicious role changes. Follow vendor updates closely for an official patch or temporary fix.