This vulnerability is a missing authorization flaw that lets attackers access resources or functions meant for privileged users. By bypassing the configured access control security levels, a user could read, modify, or delete data that should otherwise be protected. The weakness is rooted in improper enforcement of authorization policies (CWE-862).

The affected product is Kings Plugins B2BKing, a WordPress plugin used for wholesale functionality. All releases before version 5.2.10 are impacted; versions 5.2.10 and newer contain the fix.

The CVSS score of 4.9 indicates a moderate impact; the EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is a normal web request to the plugin’s admin or user interfaces, where standard credentials or publicly accessible URLs allow exploitation if configuration is incorrect.