CVE-2026-96769: Extend B2B - Companies and Users Management for WooCommerce <= 2.1.4 - Unauthenticated Sensitive Information Exposure in /wp/v2/aio_company REST Endpoint
The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the registercompanyapi. This makes it possible for unauthenticated attackers to extract sensitive company data including owner and member WordPress user IDs, company billing email addresses, credit balances and full credit histories with admin user IDs, per-member purchase limits and spend totals, and shared-cart records containing purchase-order numbers.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can query the affected REST endpoint. No WordPress account or other privileges are required.
What information may be exposed?
Exposed data can include company owner and member WordPress user IDs, billing email addresses, credit balances and credit histories with administrator user IDs, member purchase limits and spending totals, and shared-cart records containing purchase-order numbers.
Which installations are affected?
Installations using Extend B2B - Companies and Users Management for WooCommerce version 2.1.4 or earlier are affected. The exposure is associated with the /wp/v2/aio_company REST endpoint.