CVE-2023-4703 is a high severity (CVSS 7.5 in NVD) flaw in the All in One B2B for WooCommerce plugin, versions through 1.0.3. An unauthenticated attacker can update the details of any user, including an administrator password. WPScan lists no known fix, so remove the plugin.
What's affected
The NVD record says the plugin, through version 1.0.3, does not properly validate parameters when updating user details. An unauthenticated attacker can update the details of any user, and changing an administrator password leads to privilege escalation.
Severity differs between sources. NVD scores the issue 7.5 and gives no CWE. WPScan gives it a CVSS of 10.0 and classifies it as privilege escalation. The gap comes from how each source rates the impact on integrity and availability, and both agree that no login is needed. Treat it as critical in practice if the plugin is active.
WPScan lists the plugin under the slug all-in-one-b2b-for-woocommerce, shows its public listing as dated 4 September 2023, and says there is no known fix.
How to check if you're exposed
List plugins with WP-CLI and look for the plugin and its version.
wp plugin list --format=table
wp plugin get all-in-one-b2b-for-woocommerce --fields=name,status,version
Then review users. Look for administrators whose email or display name changed recently, and for password resets nobody requested.
Compare the user last updated times in the database with your own change records, and check web logs for unauthenticated POST requests to admin-ajax.php.
What to do now
- Find every WooCommerce site that has this plugin installed.
- Deactivate and delete the plugin. No fixed release is known.
- Reset all administrator and shop manager passwords, and invalidate sessions.
- Review user accounts for changes, and remove any rogue administrators.
- Choose a maintained B2B extension, and check its security history before you install it.
Why it matters
The NVD record carries no weakness class, so we do not name one. The behaviour is clear enough: a function that edits user accounts runs for visitors who are not logged in, and it trusts the user id sent in the request.
Account update endpoints are a favourite target because changing one password is enough to own a shop. Orders, customer data and payment settings all sit behind that account. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. For plugins with no fix, removal is the only safe answer.
Quick check
Why do the scores differ?
NVD gives 7.5 and WPScan gives 10.0. They weigh impact differently. Both say no authentication is needed, so act as if it is critical.
Sources
Last reviewed: 19 October 2026.
