CVE-2023-3126
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadpricelist' function in versions up to and including 4.6.00. This allows authenticated attackers with subscriber or customer-level permissions to retrieve the full pricing list of all products on the site.
Risk Assessment
The organization may be exposed to the disclosure of sensitive pricing information, which could lead to a loss of competitiveness and customer trust.
Recommendation
It is recommended to update the B2BKing plugin to the latest version to mitigate this vulnerability and to conduct a user permissions audit.
Original NVD description (English source)
The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadpricelist' function in versions up to, and including, 4.6.00. This makes it possible for Authenticated attackers with subscriber or customer-level permissions to retrieve the full pricing list of all products on the site.