CVE-2026-27541
Published: 05 March 2026
Summary
CVE-2026-27541 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Designation of a manager and policy dissemination ensures privileges are assigned according to defined roles.
Regular reviews catch incorrect privilege assignments to users, roles, or processes.
Explicitly specifying privileges and group/role memberships for accounts reduces the risk of incorrect privilege assignments.
The control requires explicit definition of separated access authorizations, making incorrect privilege assignments that bundle conflicting duties harder to implement.
Ensures privileges are assigned only as necessary rather than incorrectly over-granted.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is explicitly an incorrect privilege assignment (CWE-266) that enables authenticated privilege escalation from a low-privileged WordPress user, directly mapping to exploitation of a software vulnerability to obtain higher privileges.
NVD Description
Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through <= 2.2.6.
Deeper analysisAI
CVE-2026-27541 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Wholesale Suite WordPress plugin (woocommerce-wholesale-prices) developed by Josh Kohlbach. The flaw enables privilege escalation and affects the plugin from unknown initial versions through 2.2.6. Published on 2026-03-05, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).
A low-privileged user (PR:L) can exploit this vulnerability over the network (AV:N) with high attack complexity (AC:H) and without requiring user interaction (UI:N). Successful exploitation grants high confidentiality and integrity impacts (C:H/I:H) alongside low availability impact (A:L), allowing the attacker to escalate privileges within the affected WordPress environment.
The Patchstack advisory provides further details on this privilege escalation vulnerability in the Wholesale Suite plugin: https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-prices/vulnerability/wordpress-wholesale-suite-plugin-2-2-1-privilege-escalation-vulnerability?_s_id=cve.
Details
- CWE(s)