Unauthenticated Role Assignment in B2BKing WordPress Plugin

Executive Summary

This vulnerability in the B2BKing WooCommerce plugin allows unauthenticated users to assign themselves to restricted B2B customer groups during registration without proper validation. The plugin fails to check if a selected role is actually offered on the registration form, letting attackers bypass security controls and skip manual account approval.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the B2BKing plugin in your WordPress admin panel under Plugins. If the version is below 5.2.40, the vulnerability is present. Alternatively, use WPScan to scan for vulnerable versions with: wpscan --url <your-site-url> --enumerate vp,vt

Review user registrations for unauthorized assignments to restricted B2B customer groups. Look for accounts created without manual approval that have elevated privileges.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to gain unauthorized access to restricted customer groups, bypassing approval workflows. This may lead to unauthorized discounts, bulk pricing access, or other privileges intended only for approved B2B users.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the B2BKing plugin to version 5.2.40 or later through the WordPress admin panel or by downloading the latest version from the official repository.

Audit all user accounts, especially those created recently, to ensure no unauthorized users have been assigned to restricted B2B groups. Remove any suspicious accounts.

Temporarily disable user self-registration if not required, or implement stricter validation to prevent role manipulation until the plugin is updated.

Useful 0 Not Useful 0