CVE-2023-3125

The B2BKing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'b2bking_save_price_import' function in versions up to, and including, 4.6.00. This makes it possible for Authenticated attackers with subscriber or customer-level permissions to modify the pricing of any product on the site.

• CWE-862

• https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-b2bking-plugin/Exploit, Third Party Advisory
• https://woocommerce-b2b-plugin.com/changelog/Release Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b3f2c4c3-73d6-4b3b-8eb3-c494f52dc183?source=cveBroken Link
• https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-b2bking-plugin/Exploit, Third Party Advisory
• https://woocommerce-b2b-plugin.com/changelog/Release Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b3f2c4c3-73d6-4b3b-8eb3-c494f52dc183?source=cveBroken Link

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31242An authentication bypass vulnerability exists in the OAS Eng…9.8
• CVE-2023-31244 The affected product does not properly va…7.8
• CVE-2023-31245 Devices using Snap One OvrC cloud a…6.1
• CVE-2023-31246Incorrect default permissions in some Intel(R) SDP Tool soft…7.8
• CVE-2023-31247A memory corruption vulnerability exists in the HTTP Server …9.8
• CVE-2023-31248Linux Kernel nftables Use-After-Free Local Privilege Escalat…7.8
• CVE-2023-31250The file download facility doesn't sufficiently sanitize fil…6.5
• CVE-2023-3126The B2BKing plugin for WordPress is vulnerable to unauthoriz…4.3
• CVE-2023-3127An unauthenticated user could log into iSTAR Ultra, iSTAR Ul…9.8
• CVE-2023-31271Improper access control in some Intel(R) VROC software befor…7.8
• CVE-2023-31272A stack-based buffer overflow vulnerability exists in the ht…9.8
• CVE-2023-31273Protection mechanism failure in some Intel DCM software befo…9.8