CVE-2026-14279 is a privilege escalation vulnerability in the Wholesale Market WordPress plugin by cedcommerce. The vulnerability exists because the ced_wholesale_request_send_callback() function only verifies a nonce and that the user ID is positive but does not restrict the client-supplied role_required POST parameter to an allowlist of wholesale roles. This allows authenticated users to assign themselves arbitrary roles, including Administrator, if the site administrator has enabled the 'Assigning requested role directly' feature. The vulnerability affects versions up to and including 2.2.2. No official patch or remediation guidance has been provided yet.

An authenticated attacker with Subscriber-level access or higher can escalate their privileges to Administrator, gaining full control over the WordPress site. This can lead to complete compromise of the site, including content modification, user management, and potential further exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the 'Assigning requested role directly' option to prevent exploitation. Restricting access to trusted users and monitoring for suspicious role changes is advised.