CVE-2026-66589
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing from n/a through 5.2.30.
Risk Assessment
An unauthorized person may gain access to functions or data they should not have access to, potentially leading to confidentiality or integrity breaches.
Recommendation
Update the B2BKing plugin to a version newer than 5.2.30 if available, and review access control configuration.
Other vulnerabilities in B2BKing
See all- CVE-2026-85038Medium
The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.
- CVE-2026-27346Medium
The B2BKing plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Versions before 5.2.10 are affected.
Original NVD description (English source)
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS