Role Validation Flaw in B2BKing Plugin for WooCommerce by WordPress
CVE-2026-85038
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 6 September 2026
Badges
What is CVE-2026-85038?
The B2BKing plugin for WooCommerce, prior to version 5.2.40, contains a security flaw where it fails to verify if a selected user role during registration matches the roles provided on the registration form. This oversight allows unauthenticated users to assign themselves to restricted B2B customer groups, effectively bypassing the manual approval process that is normally in place for self-registration. This vulnerability poses significant risks to user management and data integrity, necessitating prompt updates to the affected plugin version.
Affected Version(s)
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More 0 < 5.2.40
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.