CVE-2026-27346
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The B2BKing plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Versions before 5.2.10 are affected.
Risk Assessment
An attacker can gain unauthorized access to administrative functions or sensitive data, potentially leading to site compromise.
Recommendation
Update the plugin to version 5.2.10 or later.
Other vulnerabilities in B2BKing
See all- CVE-2026-85038Medium
The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.
- CVE-2026-66589Medium
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing from n/a through 5.2.30.
Original NVD description (English source)
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a before 5.2.10.