B2BKing CVE-2026-27346

Exploitation requires an authenticated account with high-level privileges within the WordPress installation running B2BKing (PR:H per CVSS vector). This limits the attack surface to internal users, compromised privileged accounts, or scenarios where an attacker has already achieved elevated WordPress access. The vulnerability is network-reachable (AV:N) with low attack complexity (AC:L) and requires no user interaction once authenticated access is obtained. The 'Authentication Bypass' tag suggests the misconfigured access control may allow privilege escalation within B2BKing's own tier system, but exploitation is still gated by the requirement for prior high-privilege authentication - unauthenticated exploitation is not supported by the CVSS vector. The vulnerability does not affect installations not using the B2BKing plugin. SSVC rates the attack as not automatable, indicating manual exploitation steps are required.

The overall risk is low-to-moderate. The CVSS score of 4.9 (Medium) is consistent with PR:H, meaning the attack is limited to already highly-privileged accounts, significantly reducing the attack surface. The integrity impact is high (I:H), but confidentiality (C:N) and availability (A:N) are unaffected, narrowing the blast radius to data or configuration tampering. EPSS of 0.02% at the 7th percentile corroborates a very low probability of exploitation in the wild at time of analysis. CISA SSVC independently rates exploitation as none and technical impact as partial, aligning with the low EPSS signal. The 'Authentication Bypass' tag creates a potential signal conflict with PR:H in the CVSS vector - if the vulnerability were a true authentication bypass it would typically carry PR:N. This conflict should be verified against the vendor advisory; the most likely interpretation is that a high-privileged B2B user can bypass authorization tiers within the plugin rather than bypassing WordPress authentication entirely. No public exploit or KEV listing has been identified.

An authenticated WordPress user with high-privileged access to the B2BKing plugin (such as a shop manager or a B2B account holder with elevated tier permissions) sends a crafted network request to a B2BKing endpoint that lacks proper authorization checks. By exploiting the missing authorization enforcement, the attacker can modify access control tier settings, pricing rules, or restricted product visibility beyond what their assigned role should permit. No public exploit code has been identified at time of analysis, and the attack requires prior authenticated access, reducing opportunistic exploitation risk.