CVE-2026-85038

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-06

Last updated on: 2026-09-08

Assigner: WPScan

Description

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-06

Last Modified

2026-09-08

Generated

2026-10-16

AI Q&A

2026-09-06

EPSS Evaluated

2026-10-14

NVD

CVE-2026-85038

EUVD

EUVD-2026-72066

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	B2BKing	— Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in the B2BKing WooCommerce plugin allows unauthenticated users to assign themselves to restricted B2B customer groups during registration without proper validation. The plugin fails to check if a selected role is actually offered on the registration form, letting attackers bypass security controls and skip manual account approval.

Detection Guidance

Check the installed version of the B2BKing plugin in your WordPress admin panel under Plugins. If the version is below 5.2.40, the vulnerability is present. Alternatively, use WPScan to scan for vulnerable versions with: wpscan --url <your-site-url> --enumerate vp,vt

Review user registrations for unauthorized assignments to restricted B2B customer groups. Look for accounts created without manual approval that have elevated privileges.

Impact Analysis

Attackers could exploit this to gain unauthorized access to restricted customer groups, bypassing approval workflows. This may lead to unauthorized discounts, bulk pricing access, or other privileges intended only for approved B2B users.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to restricted B2B customer groups. Unauthenticated users assigning themselves to these groups may bypass manual approval workflows, leading to unauthorized data access or processing, which conflicts with data protection requirements.

Mitigation Strategies

Immediately update the B2BKing plugin to version 5.2.40 or later through the WordPress admin panel or by downloading the latest version from the official repository.

Audit all user accounts, especially those created recently, to ensure no unauthorized users have been assigned to restricted B2B groups. Remove any suspicious accounts.

Temporarily disable user self-registration if not required, or implement stricter validation to prevent role manipulation until the plugin is updated.

Hi! I’m here to help you understand CVE-2026-85038. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70