B2Bking Ultimate Woocommerce B2B And Wholesale Plugin Wholesale Prices Bulk Order Form More
Monthly
Unauthorized role self-assignment in the B2BKing WooCommerce plugin before version 5.2.40 allows unauthenticated registrants to claim restricted B2B customer group memberships without admin approval by supplying arbitrary role parameters not bounded by server-side validation. The plugin fails to verify that a role submitted during account registration is actually one offered on the public registration form, enabling any user to bypass the manual account-approval workflow and gain access to wholesale pricing tiers or restricted catalogs. A publicly available proof-of-concept exists via WPScan, though no confirmed active exploitation has been identified in CISA KEV at time of analysis.
Unauthorized role self-assignment in the B2BKing WooCommerce plugin before version 5.2.40 allows unauthenticated registrants to claim restricted B2B customer group memberships without admin approval by supplying arbitrary role parameters not bounded by server-side validation. The plugin fails to verify that a role submitted during account registration is actually one offered on the public registration form, enabling any user to bypass the manual account-approval workflow and gain access to wholesale pricing tiers or restricted catalogs. A publicly available proof-of-concept exists via WPScan, though no confirmed active exploitation has been identified in CISA KEV at time of analysis.