CVE-2026-93344

The MarketKing plugin for WooCommerce contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects MarketKing versions up to and including 2.1.72.

Broken Access Control vulnerability in the MarketKing plugin in versions up to and including 2.1.70. The vulnerability can be exploited by an unauthenticated attacker.

The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory. By sending a crafted AJAX request, they can obtain internal user IDs, usernames, and email addresses of all registered vendors, exposing personally identifiable information.

The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification, copy any vendor's product listings including private metadata, and assign the duplicate to their own account without the victim's consent.

The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers can submit crafted AJAX requests to create fraudulent refund requests against orders they did not place, causing marketplace disruption and unauthorized interference.

Missing Authorization vulnerability in MarketKing by Kings Plugins allows exploiting incorrectly configured access control security levels. Affects versions through 2.1.60.

The MarketKing plugin for WordPress versions 2.1.40 and earlier contains a broken access control vulnerability exploitable by an unauthenticated attacker.

The WordPress plugin MarketKing (marketking-multivendor-marketplace-for-woocommerce) up to version 2.0.92 is vulnerable to stored XSS due to improper input neutralization during page generation. An attacker can inject malicious code that gets stored and executed in the user's browser.