CVE-2026-28106 MEDIUM

CVE-2026-28106: WordPress B2BKing Premium plugin < 5.4.20 - Open Redirection vulnerability

Vendor Kings Plugins

Product B2BKing Premium

Weakness CWE-601 · Open redirect

Published March 6, 2026

Last update March 9, 2026

View on NVD All CVEs

CVSS base score

4.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This issue affects B2BKing Premium: from n/a before 5.4.20.

Explanation of Vulnerability in Simple Terms

02Summary

B2BKing Premium contains an open redirect vulnerability that allows an attacker to redirect users to an external website. The vulnerability requires user interaction—the victim must click a malicious link. The redirect can occur across different security contexts, potentially affecting user trust and enabling phishing attacks.

What an attacker can do

03Attacker Capabilities

Redirect site visitors to an external website via a crafted link.

Potential impact on your site

04Site Impact

Users may be redirected to phishing or malicious sites, damaging trust in your B2BKing installation.

Conditions required to exploit

05Prerequisites

Victim must click a malicious link; no authentication required.

Key dates

06Disclosure timeline

March 6, 2026 CVE published

March 9, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-28106 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/601.html AskarLabs — CWE-601 write-up URL Redirection to Untrusted Site (Open Redirect)

Related vulnerabilities