CVE-2026-93343
MediumCVSS 6.5Summary
The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory. By sending a crafted AJAX request, they can obtain internal user IDs, usernames, and email addresses of all registered vendors, exposing personally identifiable information.
Risk Assessment
Exposure of vendor personal data can lead to privacy breaches and potential phishing attacks. It requires authentication but any user with basic access can exploit it.
Recommendation
Update the MarketKing plugin to version 2.1.72 or later. Also review user permissions and restrict access to admin functions.
Other vulnerabilities in MarketKing
See all- CVE-2026-93344Medium
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor user ID. Attackers can bypass authorization controls by submitting a target vendor ID in the request to access payout pages, financial reports, and vendor dashboard content belonging to any vendor in the marketplace.
- CVE-2026-93342Medium
The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification, copy any vendor's product listings including private metadata, and assign the duplicate to their own account without the victim's consent.
- CVE-2026-93341Medium
The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers can submit crafted AJAX requests to create fraudulent refund requests against orders they did not place, causing marketplace disruption and unauthorized interference.
- CVE-2026-27399Medium
The MarketKing plugin for WordPress versions 2.1.40 and earlier contains a broken access control vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-85311Medium
Missing Authorization vulnerability in MarketKing by Kings Plugins allows exploiting incorrectly configured access control security levels. Affects versions through 2.1.60.
Original NVD description (English source)
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request. Attackers can exploit the absence of capability checks in the vendor management action to retrieve internal user IDs, usernames, and email addresses of all registered vendors, exposing personally identifiable information to any logged-in user regardless of role.