Missing Authorization in MarketKing WordPress Plugin

Executive Summary

CVE-2026-93341 is a missing authorization vulnerability in the MarketKing WordPress plugin before version 2.1.72. It exists in the marketking_send_refund AJAX action, allowing authenticated users with subscriber-level access or higher to create refund requests for any order by providing an arbitrary order ID. This enables attackers to submit fraudulent refund requests for orders they did not place.

Useful 0 Not Useful 0

Detection Guidance

Check WordPress plugin versions. Run: wp plugin list --name=marketking. If version is below 2.1.72, the plugin is vulnerable. Inspect server logs for AJAX requests to marketking_send_refund with arbitrary order IDs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to disrupt the marketplace by creating unauthorized refund requests for any order. It can interfere with other users' transactions, potentially leading to financial losses or reputational damage for store owners and vendors using the plugin.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized refund requests, which may involve processing or altering personal data without proper authorization. GDPR requires strict data protection and user consent for transactions, while HIPAA mandates safeguards for protected health information. Unauthorized refunds could violate these requirements by interfering with legitimate transactions and user data integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Update MarketKing plugin to version 2.1.72 or later immediately. Disable the refund request feature if not needed. Monitor for suspicious refund requests in order logs.

Useful 0 Not Useful 0