Vulnerability · Published Mar 19, 2026 · Assigned by Patchstack
CVE-2026-27542WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability
Critical 9.8
In plain English
A critical-severity security flaw in Woocommerce Wholesale Lead Capture from Rymera Web Co Pty Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.8%top 21.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC
Official description
Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Escalation. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rymera Web Co Pty Ltd. | Woocommerce Wholesale Lead Capture | 0 – through 2.0.3.1 |
Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H