CodeAtoZ B2B Suite CVE-2026-105969

Exploitation requires that the CodeAtoZ B2B Suite for WooCommerce plugin (version before 1.6.1) be installed and its guest quote-submission feature in use, since the flaw is in retrieval of guest-submitted quotes. No authentication, user interaction, or special configuration is needed - an unauthenticated remote attacker simply supplies an enumerable quote identifier against default functionality. The only practical limiting factor is that a target quote must exist and the identifier must be predictable/enumerable (which the description confirms it is); impact is bounded to disclosure of quote data (buyer name, email, requested line items) and does not extend to data modification or site compromise.

This is a genuine but moderate-severity issue, appropriately rated rather than inflated. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation requiring no user interaction, which maximizes reachability, but impact is deliberately scoped low: only confidentiality is affected (C:L/I:N/A:N), reflecting disclosure of guest quote data rather than code execution or account takeover. Signals are largely consistent: EPSS is low (0.18%, 7th percentile), SSVC reports Exploitation=none (no observed active exploitation) yet Automatable=yes with Technical Impact=partial, and a public PoC exists via WPScan. The combination of 'automatable yes' plus an enumerable identifier means mass-scraping of quote records is practical at scale, which elevates real-world concern above the modest 5.3 base score for sites holding sensitive B2B buyer data. It is not a KEV entry and there is no evidence of in-the-wild exploitation, so this should be prioritized as a privacy/data-exposure patch rather than an emergency RCE-class incident. No conflicting signals were identified between the CVSS vector and the description - both agree on network-reachable, unauthenticated information disclosure.

An unauthenticated attacker scripts requests against the plugin's guest-quote retrieval endpoint, incrementing or guessing the enumerable quote identifier to pull back quote records belonging to other guests. Because the identifier is enumerable and the process is automatable, the attacker harvests buyer names, email addresses, and requested line items in bulk. A public proof-of-concept is available from WPScan, lowering the effort required to reproduce the attack.