Description

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-06T07:16:43.530Z",
  "pubdate": "2026-09-06T07:16:43.530Z",
  "executiveSummary": "The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin for WordPress, in versions prior to 5.2.40, contains a critical security vulnerability related to improper input validation during the registration process.\nThis flaw allows unauthenticated attackers to perform privilege escalation by manipulating registration request parameters. By circumventing server-side validation checks, an attacker can assign themselves to restricted B2B customer groups that are intended to be managed by site administrators.\nFurthermore, this vulnerability enables attackers to bypass mandatory manual account-approval workflows, effectively granting them immediate access to restricted wholesale pricing, bulk order forms, and other B2B-specific features without authorization.\nThe vulnerability poses a significant risk to the integrity of the B2B ecosystem, as unauthorized users gain access to sensitive wholesale data and privileged account status. Exploitation does not require prior authentication, making it a critical threat to any WordPress installation utilizing affected versions of B2BKing.",
  "technicalDetails": "The root cause of this vulnerability lies in the plugin's failure to perform adequate server-side validation of the 'role' parameter submitted during the user registration process. Specifically, the application logic assumes that the role selected by the user during the sign-up flow is restricted to the pre-approved options presented on the registration form.\nDuring the registration request, the plugin fails to cross-reference the user-supplied role identifier against a whitelist of valid, publicly assignable roles. An attacker can intercept the HTTP POST request triggered during registration and inject a restricted B2B group ID into the payload. Because the backend does not re-validate the integrity of this input, the system assigns the user to the arbitrary group specified in the request.\nThe exploitation flow is as follows: 1. An attacker navigates to the public registration page of a WordPress site running the vulnerable plugin. 2. The attacker triggers a registration request, capturing the traffic using an interception proxy. 3. The attacker modifies the parameters of the request to include a role identifier corresponding to a restricted B2B customer group (e.g., a 'Wholesaler' or 'Premium' tier group). 4. Upon submission, the plugin processes the registration and assigns the unauthorized role to the new user account. 5. Consequently, the user is automatically granted elevated privileges associated with that group, bypassing any administrative approval queue that would typically flag such account upgrades.\nThe impact of this vulnerability is significant, as it effectively nullifies the 'Manual Approval' settings configured for B2B accounts. By manipulating the registration payload, the attacker effectively elevates their account status upon creation, gaining access to restricted wholesale prices, private category views, and B2B-exclusive order functionality. This bypasses the security boundary established for commercial B2B transactions and potentially exposes sensitive business-to-business pricing structures to unauthorized entities. The lack of authentication requirements for the registration endpoint facilitates automated exploitation attempts by malicious actors against public-facing WordPress installations."
}