EXTEND B2B - COMPANIES AND USERS MANAGEMENT FOR WOOCOMMERCE · CVE-2026-96769 · Package
NO FIX YET · SEE WHAT TO DO
The Extend B2B Companies and Users Management plugin for WooCommerce exposes sensitive company data through its register_company_api endpoint in versions up to and including 2.1.4. An unauthenticated attacker can read owner and member user IDs, billing emails, credit balances and histories, purchase limits, and purchase-order numbers.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Extend B2B - Companies and Users Management plugin for WooCommerce at version 2.1.4 or earlier are exposed through the register_company_api endpoint, which needs no login. Sites that do not run this plugin are not affected.
Not affected if plugin-above-2.1.4, plugin-not-installed
Who cares b2b, woocommerce, wordpress
wp-content/plugins/ for the plugin folder.2.1.4; the sources do not name the fixed version.The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the register_company_api. This makes it possible for unauthenticated attackers to extract sensitive company data including owner and member WordPress user IDs, company billing email addresses, credit balances and full credit histories with admin user IDs, per-member purchase limits and spend totals, and shared-cart records containing purchase-order numbers.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.