B2BKing Plugin CVE-2026-85038

Exploitation requires that the target WordPress site runs the B2BKing plugin in a version prior to 5.2.40 with public self-registration enabled - a standard configuration for B2B portals that allow customers to apply for accounts. No authentication is required; the attacker operates as an anonymous user submitting the registration form. Impact is contingent on meaningful privileges being attached to B2B customer groups (wholesale pricing, restricted product visibility, bulk order access). Sites where all user accounts are admin-created (no public registration) or where all customer groups carry identical privileges are not meaningfully exposed. No platform-specific restriction applies beyond WordPress and WooCommerce being installed.

The CVSS base score of 5.3 (Medium) reflects limited direct technical impact - the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates network-accessible, zero-authentication exploitation with only low integrity impact. However, the business impact for WooCommerce B2B operators may substantially exceed the CVSS rating: unauthorized access to wholesale pricing tiers enables purchasing at unauthorized discounts, competitive intelligence gathering through restricted catalogs, and circumventing vendor-controlled customer onboarding. Even a mid-sized wholesale distributor in gdynia managing a B2B portal would face direct revenue loss if attackers exploited this at scale. The public proof-of-concept published by WPScan meaningfully lowers the technical barrier, making opportunistic exploitation by automated scanners plausible. No EPSS data was provided in the input, and the absence of a CISA KEV listing suggests no confirmed widespread exploitation as of this analysis, but the combination of a trivial attack path and a public PoC warrants prompt remediation rather than risk acceptance.

An attacker opens the B2BKing registration page on a WooCommerce store, uses a browser proxy to intercept the POST request, and changes the role parameter from the publicly visible default (e.g., standard retail customer) to the identifier of a restricted wholesale group (e.g., a VIP B2B tier). The plugin server accepts this unvalidated role value, creates the account with the restricted group membership, and skips the manual approval gate - granting the attacker immediate access to wholesale pricing and restricted catalog items. A public proof-of-concept on WPScan makes this reproducible with minimal technical expertise.