CVE-2026-111847 in MarketKing Plugin
Summary
by MITRE • 10/23/2026
Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The identified security flaw represents a critical failure in access control mechanisms within the Kings Plugins MarketKing multivendor marketplace for WooCommerce, specifically affecting versions ranging from non-existent initial releases up to version 2.1.72. This vulnerability stems from an improper implementation of authorization checks, allowing attackers to bypass intended restrictions and perform actions that should be limited to authenticated administrators or specific vendor roles. In the context of web application security, this is a classic example of broken access control where the server fails to properly verify whether the user requesting a resource has the necessary permissions to do so. The absence of robust authorization logic means that any actor with network connectivity to the vulnerable instance can manipulate requests to escalate privileges or access sensitive data without valid credentials for those specific actions.
From a technical perspective, this flaw likely involves endpoints related to vendor management, product listing modifications, order processing, or administrative settings where input parameters are not sufficiently validated against the current user's session permissions. An attacker could exploit this by crafting HTTP requests that target internal APIs or admin-ajax handlers associated with the plugin. By manipulating these requests, such as altering post IDs, changing role-based flags in form submissions, or directly invoking functions meant for higher-privilege users, the malicious actor can execute unauthorized operations. This type of vulnerability is frequently categorized under CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, highlighting the fundamental breakdown in enforcing least privilege principles within the application logic.
The operational impact of this vulnerability is severe for e-commerce platforms relying on MarketKing to manage multi-vendor environments. Successful exploitation could lead to unauthorized modification or deletion of products, manipulation of pricing structures, alteration of commission rates, and potentially full compromise of vendor accounts. In a multivendor setup, where multiple sellers operate under a single platform umbrella, the breach of one account can have cascading effects on trust and financial integrity across the entire marketplace. Attackers could also use this access to inject malicious scripts into product descriptions or store settings, leading to cross-site scripting attacks against customers or further lateral movement within the server infrastructure if file upload capabilities are exposed through these endpoints.
Mitigation strategies must prioritize immediate remediation by upgrading the MarketKing plugin to a version newer than 2.1.72 where this authorization logic has been corrected. If an upgrade is not immediately feasible, administrators should implement strict input validation and ensure that all sensitive operations verify user roles server-side rather than relying on client-side checks or insecure assumptions about request origin. Additionally, deploying a Web Application Firewall can provide temporary protection by blocking known exploitation patterns associated with broken access control attacks. Regular security audits focusing on role-based access controls are essential to prevent similar issues in future updates and maintain the integrity of the multivendor ecosystem. This incident underscores the importance of rigorous testing for privilege escalation vectors during software development life cycles, aligning with ATT&CK techniques related to account manipulation and unauthorized access within cloud or web application environments.