CVE-2026-28106

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28106", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-25T12:14:02.974Z", "datePublished": "2026-03-06T11:49:35.492Z", "dateUpdated": "2026-03-09T08:03:30.146Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-09T08:03:30.146Z"}, "title": "WordPress B2BKing Premium plugin < 5.4.20 - Open Redirection vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-98", "descriptions": [{"lang": "en", "value": "CAPEC-98 Phishing"}]}], "affected": [{"vendor": "Kings Plugins", "product": "B2BKing Premium", "versions": [{"status": "affected", "version": "n/a", "lessThan": "5.4.20", "changes": [{"at": "5.4.20", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This issue affects B2BKing Premium: from n/a before 5.4.20.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.<p>This issue affects B2BKing Premium: from n/a before 5.4.20.</p>"}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/b2bking/vulnerability/wordpress-b2bking-premium-plugin-5-3-80-open-redirection-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Update the WordPress B2BKing Premium plugin to the latest available version (at least 5.4.20).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update the WordPress B2BKing Premium plugin to the latest available version (at least 5.4.20)."}]}], "credits": [{"lang": "en", "value": "0xd4rk5id3 | Patchstack Bug Bounty Program", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T14:42:51.073164Z", "id": "CVE-2026-28106", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T14:44:16.857Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28106", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T14:42:51.073164Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T14:44:05.225Z"}}], "cna": {"title": "WordPress B2BKing Premium plugin < 5.4.20 - Open Redirection vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "0xd4rk5id3 | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-98", "descriptions": [{"lang": "en", "value": "CAPEC-98 Phishing"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Kings Plugins", "product": "B2BKing Premium", "versions": [{"status": "affected", "changes": [{"at": "5.4.20", "status": "unaffected"}], "version": "n/a", "lessThan": "5.4.20", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress B2BKing Premium plugin to the latest available version (at least 5.4.20).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress B2BKing Premium plugin to the latest available version (at least 5.4.20).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/b2bking/vulnerability/wordpress-b2bking-premium-plugin-5-3-80-open-redirection-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This issue affects B2BKing Premium: from n/a before 5.4.20.", "supportingMedia": [{"type": "text/html", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.<p>This issue affects B2BKing Premium: from n/a before 5.4.20.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-09T08:03:30.146Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28106", "state": "PUBLISHED", "dateUpdated": "2026-03-09T08:03:30.146Z", "dateReserved": "2026-02-25T12:14:02.974Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-06T11:49:35.492Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "B2BKing Premium", "vendor": "Kings Plugins", "versions": [{"changes": [{"at": "5.4.20", "status": "unaffected"}], "lessThan": "5.4.20", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This issue affects B2BKing Premium: from n/a before 5.4.20."}, {"lang": "es", "value": "Redirecci\u00f3n de URL a sitio no confiable ('Redirecci\u00f3n abierta') vulnerabilidad en Kings Plugins B2BKing Premium permite Phishing. Este problema afecta a B2BKing Premium: desde n/a antes de 5.4.20."}], "id": "CVE-2026-28106", "lastModified": "2026-06-17T10:28:15.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28106", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T14:42:51.073164Z", "version": "2.0.3"}}]}, "published": "2026-03-06T12:15:55.063", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/b2bking/vulnerability/wordpress-b2bking-premium-plugin-5-3-80-open-redirection-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.3.80]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "B2BKing Premium", "source": "cna", "vendor": "Kings Plugins"}, "product": "b2bking_premium", "vendor": "kings_plugins"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-17T12:20:50.929227+00:00", "value": {"mitigation_remediation": ["Update the B2BKing Premium plugin to version 5.4.20 or later.", "Configure a web application firewall or reverse proxy to filter or block URL parameters that attempt external redirects.", "Educate site administrators and users to verify the destination of links before following them, and monitor for suspicious phishing attempts."], "summary": {"action": "Apply Patch", "impact": "Open Redirection leading to phishing"}, "threat_synthesis": {"affected_systems": "Kings Plugins B2BKing Premium, all installations of the plugin prior to version 5.4.20, regardless of other WordPress components or hosting configurations.", "description_and_impact": "The vulnerability enables an attacker to redirect a user from a trusted WordPress site to an arbitrary URL, facilitating phishing and social\u2011engineering attacks. The weakness originates from improper validation of URL parameters, classified as CWE\u2011601, and allows attackers to craft a malicious link that appears to come from a legitimate source. If exploited, the affected user may unknowingly disclose credentials or sensitive information to the attacker after being redirected.", "risk_and_exploitability": "The CVSS score of 4.7 indicates a moderate risk level. Exploitation probability is very low, with an EPSS score below 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path is through a crafted URL presented to a user via email, blog, or infected content on the site, persisting the need for victim interaction but offering a straightforward exploitation method for anyone able to construct and share the malicious link."}}}}, "created": "2026-03-09T10:08:06.650285+00:00", "updated": "2026-04-17T12:30:06.225777+00:00", "vendors": ["kings_plugins", "kings_plugins$PRODUCT$b2bking_premium", "wordpress", "wordpress$PRODUCT$wordpress"]}