CVE-2026-105969: CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure
The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable identifier.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CodeAtoz B2B Suite for WooCommerceto a version that resolves this vulnerability.Fixed in 1.6.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using CodeAtoz B2B Suite for WooCommerce versions earlier than 1.6.1 are affected, particularly where guests can submit quotes. The exposed records can include guest buyers' names, email addresses, and requested line items.
What does an attacker need to exploit it?
An attacker does not need to authenticate. They need to supply an enumerable identifier for another guest-submitted quote.
How can we determine whether data may have been exposed?
Review whether the site allowed guest quote submissions while running a version earlier than 1.6.1, and assess access or application logs for requests retrieving quote records with varying identifiers. The provided information does not identify specific request paths or log signatures.