CVE-2026-85038
MediumCVSS 5.3Summary
The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.
Risk Assessment
An attacker can gain access to privileged B2B groups without approval, potentially leading to unauthorized access to special pricing or content, and bypassing the account approval process.
Recommendation
Update the B2BKing plugin to version 5.2.40 or later, which includes the fix.
Other vulnerabilities in B2BKing
See all- CVE-2026-66589Medium
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing from n/a through 5.2.30.
- CVE-2026-27346Medium
The B2BKing plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Versions before 5.2.10 are affected.
Original NVD description (English source)
The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.