CVE-2026-66589: B2BKing Auth Bypass Vulnerability

CVE-2026-66589 Overview

CVE-2026-66589 is a Missing Authorization vulnerability [CWE-862] in the Kings Plugins B2BKing plugin for WooCommerce. The flaw affects all B2BKing versions up to and including 5.2.30. Authenticated attackers with low privileges can exploit incorrectly configured access control checks to reach functionality that should be restricted. The vulnerability requires network access and low attack complexity, and it impacts both confidentiality and integrity at a limited level. Availability is not affected. No public proof-of-concept is available at this time, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Authenticated users with minimal privileges can bypass access control checks in B2BKing and interact with functionality intended for higher-privileged roles, leading to limited disclosure and modification of B2B commerce data.

Affected Products

Kings Plugins B2BKing plugin for WordPress/WooCommerce
B2BKing versions from n/a through 5.2.30
WordPress sites running the B2BKing wholesale extension for WooCommerce

Discovery Timeline

2026-08-18 - CVE-2026-66589 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-66589

Vulnerability Analysis

The vulnerability is a Broken Access Control issue in B2BKing, a WordPress plugin that adds business-to-business wholesale functionality to WooCommerce. One or more request handlers in the plugin fail to verify that the authenticated caller holds the role or capability required for the requested operation. As a result, low-privileged authenticated users can invoke actions or read data that should be gated to administrators or approved B2B roles. The confidentiality and integrity impact is bounded because the vulnerability does not grant full administrative control, but attackers can still read and modify a subset of protected B2B data such as customer group settings, pricing rules, or account-related fields.

Root Cause

The root cause is a missing authorization check on plugin endpoints. The plugin authenticates the request but does not enforce a current_user_can() capability check or an equivalent role validation before performing sensitive actions. Nonce verification alone, if present, does not establish authorization because a nonce only confirms request origin. B2BKing implements security levels for access control, but at least one path is incorrectly configured and does not enforce the intended level.

Attack Vector

An attacker must hold a valid low-privileged account on the target site, such as subscriber or a basic B2B customer role. The attacker then issues an HTTP request to the vulnerable plugin endpoint over the network. Because the endpoint accepts the request without verifying role or capability, the server processes the action as if it were authorized. Exploitation does not require user interaction. See the Patchstack Vulnerability Report for advisory details.

No verified exploit code is publicly available. The vulnerability mechanism is described in prose based on the CWE-862 classification and the Patchstack advisory.

Detection Methods for CVE-2026-66589

Indicators of Compromise

HTTP requests to B2BKing AJAX or REST endpoints originating from accounts that do not hold administrator or approved B2B roles.
Unexpected changes to B2BKing configuration objects, wholesale pricing rules, or customer group memberships in the WordPress database.
WordPress audit log entries showing privileged plugin actions performed by low-privileged users.

Detection Strategies

Review web server access logs for POST requests to admin-ajax.php with B2BKing-related action parameters submitted by non-administrative sessions.
Correlate WordPress user role with the plugin actions invoked, and alert on mismatches between caller role and required privilege.
Compare B2BKing configuration and pricing tables against a known-good baseline to identify unauthorized modifications.

Monitoring Recommendations

Enable a WordPress activity log plugin that records user actions, role changes, and plugin option updates.
Forward WordPress and web server logs to a centralized SIEM or data lake for retention and correlation with authentication events.
Monitor creation of new users assigned to B2B roles and any elevation of existing accounts.

How to Mitigate CVE-2026-66589

Immediate Actions Required

Upgrade B2BKing to a version later than 5.2.30 as soon as the vendor releases a fixed build listed in the Patchstack Vulnerability Report.
Audit existing WordPress accounts and remove or downgrade any low-privileged users that do not require access to the B2B storefront.
Review recent B2BKing configuration changes and pricing rule modifications for unauthorized activity.

Patch Information

At the time of publication, the NVD entry lists the affected range as n/a through 5.2.30. Site operators should consult the Patchstack advisory and the Kings Plugins changelog for the specific fixed version and apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Restrict access to /wp-admin/admin-ajax.php and B2BKing REST routes at the web application firewall for requests originating from non-administrative sessions.
Temporarily disable the B2BKing plugin on sites where the wholesale functionality is not actively required until a patched version is installed.
Enforce strong authentication and multi-factor authentication on all WordPress accounts to reduce the pool of accounts an attacker can use to reach the vulnerable endpoints.

bash

# Update the B2BKing plugin using WP-CLI once a fixed version is available
wp plugin update b2bking-wholesale-for-woocommerce

# List current B2B-related user accounts for review
wp user list --role=b2bking_b2buser --fields=ID,user_login,user_email,user_registered

# Deactivate the plugin as a temporary workaround
wp plugin deactivate b2bking-wholesale-for-woocommerce