CVE-2026-27346: B2BKing Authorization Bypass Vulnerability

CVE-2026-27346 Overview

CVE-2026-27346 is a missing authorization vulnerability [CWE-862] in the Kings Plugins B2BKing plugin for WooCommerce. The flaw stems from incorrectly configured access control on protected functionality. Authenticated users with elevated privileges can exploit this gap to perform actions outside their intended permission boundary. The issue affects all B2BKing versions prior to 5.2.10.

Critical Impact
Authenticated attackers with high privileges can bypass access control checks to modify data on WooCommerce stores running vulnerable B2BKing versions, compromising integrity of B2B pricing, customer groups, and order workflows.

Affected Products

Kings Plugins B2BKing (Wholesale for WooCommerce)
B2BKing versions before 5.2.10
WordPress installations using the B2BKing plugin for B2B commerce

Discovery Timeline

2026-05-25 - CVE-2026-27346 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-27346

Vulnerability Analysis

The vulnerability is a broken access control issue in the B2BKing plugin, a B2B and wholesale extension for WooCommerce. B2BKing exposes administrative and B2B-specific actions through plugin endpoints. One or more of these endpoints fail to verify that the calling user holds the capability required to invoke the action. An authenticated attacker can issue crafted requests directly to the unprotected handler. The handler executes the requested operation without confirming the caller is authorized for it. This results in unauthorized modification of plugin-managed data such as customer groups, dynamic rules, or product visibility settings. The flaw aligns with CWE-862, Missing Authorization, where the application performs a sensitive operation without checking whether the actor should be allowed to perform it.

Root Cause

The root cause is the absence of a capability check inside one or more B2BKing action handlers. WordPress plugins typically gate privileged operations using current_user_can() against a specific capability such as manage_options. B2BKing versions before 5.2.10 invoke business-logic functions without enforcing this check, relying solely on authentication state. Nonce verification alone does not constitute authorization, since any authenticated session can obtain a valid nonce.

Attack Vector

Exploitation requires the attacker to hold an authenticated account on the target WordPress site with sufficient privileges to reach the vulnerable endpoint. The attacker sends an HTTP request to the affected B2BKing admin-ajax or REST handler with parameters that invoke the protected operation. Because no capability check is performed, the server executes the action and returns a success response. No user interaction is required, and the attack is delivered over the network. The vulnerability impacts integrity but does not directly expose confidential data or cause service disruption.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-27346

Indicators of Compromise

Unexpected modifications to B2BKing customer groups, dynamic rules, or wholesale pricing tiers in the WordPress database
POST requests to /wp-admin/admin-ajax.php with B2BKing-specific action parameters originating from low-privileged authenticated accounts
Audit log entries showing B2BKing configuration changes performed by users who should not have plugin administrative rights

Detection Strategies

Inspect web server access logs for authenticated requests to B2BKing AJAX or REST endpoints from non-administrator accounts
Compare the installed B2BKing plugin version against 5.2.10 across all WordPress hosts in the environment
Enable WordPress activity logging plugins to record capability-sensitive plugin operations and review for anomalies

Monitoring Recommendations

Forward WordPress and web server logs to a centralized SIEM and alert on B2BKing endpoint access by non-admin users
Baseline normal B2BKing administrative activity volume and alert on deviations
Monitor plugin file integrity and database table changes for B2BKing-managed entities

How to Mitigate CVE-2026-27346

Immediate Actions Required

Update B2BKing to version 5.2.10 or later on all WordPress sites where the plugin is installed
Audit existing B2BKing configuration, user groups, and pricing rules for unauthorized modifications
Review WordPress user accounts and remove unused or excessive privilege assignments that could be leveraged to exploit the flaw

Patch Information

The vendor has released B2BKing version 5.2.10, which addresses the missing authorization condition. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI. Validate the upgrade by confirming the reported plugin version in Plugins > Installed Plugins after deployment. See the Patchstack Vulnerability Report for the official patch reference.

Workarounds

If immediate patching is not possible, restrict access to /wp-admin/ and admin-ajax.php using a web application firewall rule that filters B2BKing action parameters
Temporarily deactivate the B2BKing plugin until the update can be applied
Reduce the number of users holding shop manager or higher privileges to minimize the exploitable attacker population

bash

# Configuration example
wp plugin update b2bking-wholesale-for-woocommerce --version=5.2.10
wp plugin get b2bking-wholesale-for-woocommerce --field=version