CVE-2023-3126

low-risk

Published 2023-06-07

The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadpricelist' function in versions up to, and including, 4.6.00. This makes it possible for Authenticated attackers with subscriber or customer-level permissions to retrieve the full pricing list of all products on the site.

Do I need to act?

0.14% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

B2Bking

Affected Vendors

Webwizards

References (6)

Exploit https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-b2bking-plugin/

Release Notes https://woocommerce-b2b-plugin.com/changelog/

Broken Link https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e3ac14-1421-49f0-9c6...

Exploit https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-b2bking-plugin/

Release Notes https://woocommerce-b2b-plugin.com/changelog/

Broken Link https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e3ac14-1421-49f0-9c6...

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal