CVE-2026-85038

Name of the Vulnerable Software and Affected Versions B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More versions prior to 5.2.40

Description Unauthenticated users can assign themselves to restricted B2B customer groups and bypass the manual account-approval workflow during self-registration. This occurs because the plugin fails to validate whether the registration role submitted by the user is actually among the publicly available, published, and selectable roles offered on the registration form.

Recommendations Update to version 5.2.40 or later.