Description

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T23:17:04.787Z",
  "pubdate": "2026-08-18T23:17:04.787Z",
  "executiveSummary": "A Missing Authorization vulnerability has been identified in Kings Plugins B2BKing, specifically affecting versions from n/a through 5.2.30. This security flaw stems from improperly configured access control security levels within the plugin's architecture, allowing unauthorized threat actors to bypass intended authorization boundaries.\nThe primary impact of this vulnerability is the potential exploitation of incorrectly configured access controls, which may grant unauthorized users access to privileged functionality, restricted administrative features, or sensitive business-to-business data depending on the specific endpoints exposed.\nThe affected product is B2BKing by Kings Plugins, a comprehensive B2B and wholesale solution for WordPress. The risk implications are significant for e-commerce platforms utilizing the plugin, as successful exploitation could lead to unauthorized data exposure, privilege escalation, or unauthorized modification of system settings.\nTo exploit this vulnerability, an attacker requires network access to the target WordPress instance. Depending on the specific endpoint lacking proper authorization checks, the attacker capabilities may range from unauthenticated requests to low-privileged user abuse, leveraging missing function-level access controls to execute unauthorized actions.",
  "technicalDetails": "The root cause of this vulnerability lies in a Missing Authorization flaw, categorized under improper access control implementation within Kings Plugins B2BKing versions from n/a through 5.2.30. The vulnerable component fails to adequately verify whether an incoming request possesses the appropriate security level, user role, or capability before executing sensitive functions or rendering restricted data.\nFrom a network exposure perspective, the vulnerable handlers or AJAX endpoints are accessible via HTTP/HTTPS requests processed by the underlying WordPress environment. The vulnerability typically manifests when functions handling specific B2B operations omit proper capability checks (such as current_user_can() or nonce verification in WordPress contexts) prior to processing the request payload.\nThe attack flow proceeds as follows: First, an attacker identifies the exposed administrative or privileged functionality endpoints associated with B2BKing. Second, the attacker crafts an HTTP request targeting these functions directly, bypassing the standard user interface where access controls might visually restrict navigation. Third, because the underlying backend logic lacks requisite authorization validation, the application processes the request and executes the requested functionality.\nAuthentication and privilege requirements vary based on the specific endpoint targeted, but the vulnerability fundamentally allows users with insufficient privileges—or in some cases unauthenticated actors—to perform actions reserved for higher privilege tiers, such as administrators or specific B2B user roles. The payload behavior involves submitting standard HTTP GET or POST requests designed to invoke the unprotected backend functions.\nThe post-exploitation impact includes unauthorized access to sensitive B2B data, potential manipulation of customer or wholesale configurations, and the degradation of the overall security posture of the e-commerce platform. Without strict enforcement of access control security levels, the application remains vulnerable to unauthorized functional invocation."
}