Cyber Posture

CVE-2026-27541

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0005 14.1th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27541 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068).
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-266

Designation of a manager and policy dissemination ensures privileges are assigned according to defined roles.

addresses: CWE-266

Regular reviews catch incorrect privilege assignments to users, roles, or processes.

addresses: CWE-266

Explicitly specifying privileges and group/role memberships for accounts reduces the risk of incorrect privilege assignments.

addresses: CWE-266

The control requires explicit definition of separated access authorizations, making incorrect privilege assignments that bundle conflicting duties harder to implement.

addresses: CWE-266

Ensures privileges are assigned only as necessary rather than incorrectly over-granted.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

The vulnerability is explicitly an incorrect privilege assignment (CWE-266) that enables authenticated privilege escalation from a low-privileged WordPress user, directly mapping to exploitation of a software vulnerability to obtain higher privileges.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through <= 2.2.6.

Deeper analysisAI

CVE-2026-27541 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Wholesale Suite WordPress plugin (woocommerce-wholesale-prices) developed by Josh Kohlbach. The flaw enables privilege escalation and affects the plugin from unknown initial versions through 2.2.6. Published on 2026-03-05, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).

A low-privileged user (PR:L) can exploit this vulnerability over the network (AV:N) with high attack complexity (AC:H) and without requiring user interaction (UI:N). Successful exploitation grants high confidentiality and integrity impacts (C:H/I:H) alongside low availability impact (A:L), allowing the attacker to escalate privileges within the affected WordPress environment.

The Patchstack advisory provides further details on this privilege escalation vulnerability in the Wholesale Suite plugin: https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-prices/vulnerability/wordpress-wholesale-suite-plugin-2-2-1-privilege-escalation-vulnerability?_s_id=cve.

Details

CWE(s)

CVEs Like This One

CVE-2026-27102Shared CWE-266
CVE-2025-69293Shared CWE-266
CVE-2026-25414Shared CWE-266
CVE-2025-31643Shared CWE-266
CVE-2025-33179Shared CWE-266
CVE-2025-69378Shared CWE-266
CVE-2025-24648Shared CWE-266
CVE-2025-1653Shared CWE-266
CVE-2025-23528Shared CWE-266
CVE-2025-67966Shared CWE-266

References