{"id":"CVE-2026-111955","revision":"6684cfe63bbd4b23919d29bb629ed654","records":[{"revision":"6684cfe63bbd4b23919d29bb629ed654","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-111955","aliases":[],"title":"WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass","description":"The WholesaleX  WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.","state":0,"publishedAt":"2026-10-21T06:00:23.127+00:00","modifiedAt":"2026-10-21T10:35:03.094+00:00","affected":[{"ecosystem":"Vendor product","name":"WholesaleX","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"WholesaleX\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.0.9\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/5fe1a629-8b05-4820-8cbe-4352c20930a3/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111955","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111955","identifiers":["CVE-2026-111955"]},"retained":false,"historicalAffected":[]}],"coverage":[]}