5.3
Medium
CVE-2026-105969 The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to…
Description
The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable identifier.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| CodeAtoZ B2B Suite for WooCommerce 1.6 | earliest → < 1.6.1 | 1.6.1 |