All vulnerabilities
CVE-2026-105969

CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure

Unknown CodeAtoZ B2B Suite for WooCommerce
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.6.1Fixed versionCVE List
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

  • 1.6.1CodeAtoZ B2B Suite for WooCommerceCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable identifier.

Text from CVE List

Affected versions 1

  • CodeAtoZ B2B Suite for WooCommerceaffected: all versions before 1.6.1CVE List

References 1