Unauthorized Data Access in B2BKing Plugin for WordPress
CVE-2023-3126

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
B2BKing — Ultimate WooCommerce Wholesale and B2B Solution
Vendor
CVE Published:
7 June 2023

Summary

The B2BKing plugin for WordPress has a serious vulnerability due to a lack of capability checks in the 'b2bkingdownloadpricelist' function. This flaw allows authenticated attackers, who possess only subscriber or customer-level permissions, to access sensitive data, specifically the comprehensive pricing list of all products available on the site. This unintended exposure of product pricing can lead to further exploitation and data breaches.

Affected Version(s)

B2BKing — Ultimate WooCommerce Wholesale and B2B Solution * <= 4.6.00

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://blog.nintechnet.com/vulnerabilities-fixed-in-word...
https://woocommerce-b2b-plugin.com/changelog/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jerome Bruandet
.