CVE-2026-85038 Overview
CVE-2026-85038 is a missing authorization vulnerability [CWE-862] in the B2BKing WordPress plugin, a WooCommerce extension for B2B and wholesale storefronts. Versions prior to 5.2.40 fail to verify that a role selected during self-registration is one actually offered on the registration form. Unauthenticated users can assign themselves to restricted B2B customer groups and bypass the manual account-approval workflow. The flaw affects the trust boundary between the registration form and the backend role assignment logic.
Critical Impact
Unauthenticated attackers can register accounts in restricted B2B customer groups and skip administrator approval, gaining access to wholesale pricing, hidden catalogs, and group-specific commerce workflows.
Affected Products
- B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin
- All versions prior to 5.2.40
- WordPress sites running WooCommerce with B2BKing self-registration enabled
Discovery Timeline
- 2026-09-06 - CVE-2026-85038 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-85038
Vulnerability Analysis
The B2BKing plugin exposes a public registration form that allows visitors to request a B2B account and select a customer group corresponding to their business type. The backend processes the submitted role identifier without cross-checking it against the roles the administrator has actually configured for public selection. An attacker can submit an arbitrary group identifier and be assigned to any B2B customer group defined on the site.
The same handler also governs the account-approval workflow. By supplying a group whose configuration bypasses manual review, the attacker's account becomes active immediately. This chain converts a missing authorization check into a business logic bypass. The result is unauthenticated access to price tiers, catalogs, and purchase permissions reserved for vetted wholesale partners.
Root Cause
The registration handler trusts a client-supplied role parameter without validating it against the server-side allowlist of publicly available groups. This is a classic missing authorization defect [CWE-862] where the server relies on the form UI to constrain input rather than enforcing the constraint in code.
Attack Vector
Exploitation requires only network access to the public registration endpoint. The attacker submits a crafted registration request specifying a restricted B2B group identifier. No authentication, user interaction, or elevated privileges are needed. Refer to the WPScan Vulnerability Report for reproduction details.
No verified public proof-of-concept code is available at the time of writing. The vulnerability mechanism can be described in prose: an HTTP POST to the plugin's registration action with a manipulated group or role field results in that group being assigned to the newly created user, and the approval flag being satisfied.
Detection Methods for CVE-2026-85038
Indicators of Compromise
- New WooCommerce user accounts assigned to restricted B2B customer groups without corresponding administrator approval log entries.
- Registration events where the submitted group or role parameter does not match any option present in the public registration form configuration.
- Sudden growth in accounts belonging to high-privilege wholesale tiers, particularly from previously unseen email domains or IP ranges.
Detection Strategies
- Audit the wp_users and wp_usermeta tables for accounts created after the plugin was installed and correlate their assigned B2BKing group against the site's public registration allowlist.
- Enable WordPress and WooCommerce audit logging to capture registration payloads and group assignments in real time.
- Deploy web application firewall rules that inspect POST bodies to the B2BKing registration endpoint and flag unexpected role or group identifiers.
Monitoring Recommendations
- Alert on any new user in a B2B group who places an order before an administrator has recorded an approval action.
- Track registration request volume from single IPs or subnets to identify automated enumeration of group identifiers.
- Review WooCommerce order records for wholesale pricing applied to accounts that bypassed manual vetting.
How to Mitigate CVE-2026-85038
Immediate Actions Required
- Update the B2BKing plugin to version 5.2.40 or later on all WordPress sites where it is installed.
- Audit all existing B2B accounts created before the patch was applied and revoke or downgrade any that were not manually approved.
- Temporarily disable public self-registration on the B2BKing form until the update is verified in staging and production.
Patch Information
The vendor released B2BKing version 5.2.40, which adds server-side validation that the submitted role or group is present in the set exposed by the registration form. Administrators should apply this update through the WordPress plugin dashboard or by replacing the plugin files manually. Confirm the installed version reflects 5.2.40 or higher after the upgrade.
Workarounds
- Disable B2BKing self-registration and require administrators to create B2B accounts manually until the patch is deployed.
- Configure the registration form to expose only a single default group and require manual promotion to sensitive tiers.
- Enforce moderation on all new WooCommerce customer accounts through a plugin or custom hook that ignores the B2BKing approval flag.
# Configuration example: force manual approval for all new users via wp-cli
wp option update b2bking_registration_enabled 0
wp user list --role=customer --format=csv > new_customers_audit.csv
# Review the CSV and delete or reassign accounts created before applying 5.2.40
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
