MarketKing WordPress Plugin Missing Authorization Vulnerability

Executive Summary

CVE-2026-93344 is a missing authorization vulnerability in the MarketKing WordPress plugin before version 2.1.72. It allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by providing an arbitrary vendor user ID. This bypasses authorization controls, enabling access to sensitive pages like payout pages, financial reports, and vendor dashboards belonging to any vendor.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your MarketKing plugin version is below 2.1.72. Inspect WordPress logs for unauthorized AJAX requests to marketking_get_page_content with arbitrary vendor IDs. Use commands like grep -r 'marketking_get_page_content' /var/log/ or check plugin version via wp plugin list in WordPress CLI.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access sensitive financial and administrative data of any vendor on the marketplace. This includes payout details, financial reports, and vendor dashboard content, potentially leading to data breaches, financial loss, or unauthorized actions performed on behalf of vendors.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal and financial data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, unauthorized disclosures, and failure to protect personally identifiable information (PII) and protected health information (PHI).

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the MarketKing plugin to version 2.1.72 or later. Remove or disable the plugin if an update is not available. Review WordPress user roles to ensure only necessary permissions are granted. Monitor for unauthorized access attempts in logs.

Useful 0 Not Useful 0