CVE-2026-85311 in MarketKing Plugin
Summary
by MITRE • 09/04/2026
Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects MarketKing: from n/a through 2.1.60.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The identified security flaw within the MarketKing plugin, specifically affecting versions up to and including 2.1.60, represents a critical failure in access control mechanisms that allows unauthorized actors to perform actions without proper authentication or authorization checks. This vulnerability stems from an incorrect configuration of security levels inherent to how the application handles user permissions for specific administrative functions or sensitive data operations. In typical WordPress plugin architectures, such as MarketKing which facilitates e-commerce and marketplace functionalities, there are often endpoints designed exclusively for administrators or verified vendors. However, due to this missing authorization check, these endpoints remain accessible to any authenticated user with even minimal privileges, such as a subscriber or customer role. This misconfiguration effectively bypasses the intended security boundaries established by the application developers, creating an avenue for privilege escalation and unauthorized data manipulation.
From a technical perspective, this vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically falling under scenarios where access control is not enforced before performing actions that affect system state or sensitive information. The root cause lies in the server-side logic failing to validate whether the current user session possesses the requisite role or capability required for the requested operation. When a request is made to modify product listings, process refunds, or alter marketplace settings, the application does not adequately verify if the requester holds an elevated privilege level. Consequently, any authenticated user can exploit this gap by crafting specific HTTP requests that target these unprotected endpoints. This type of flaw is particularly dangerous because it relies on the attacker having a valid account, which makes detection through standard intrusion prevention systems more difficult compared to unauthenticated attacks.
The operational impact of this vulnerability is significant for businesses relying on MarketKing for their online operations. An attacker with low-level access can escalate their privileges to perform high-impact actions such as modifying product prices, deleting inventory records, or accessing customer personal information including email addresses and purchase history. This not only compromises the integrity of the marketplace data but also poses severe risks regarding privacy regulations like GDPR or CCPA due to the potential exposure of personally identifiable information. Furthermore, attackers could inject malicious content into product descriptions or vendor profiles, leading to defacement issues or phishing campaigns directed at legitimate customers. The ability to alter transactional data can result in direct financial losses for vendors and platform owners, undermining trust in the marketplace ecosystem.
This vulnerability is also relevant to MITRE ATT&CK framework techniques related to Privilege Escalation and Collection of Application Data. Specifically, it maps to T1078 Valid Accounts, where attackers leverage legitimate credentials that have been compromised or created with low privileges to gain higher-level access through logical flaws rather than technical exploits like buffer overflows. The lack of proper authorization checks allows the attacker to move laterally within the application's feature set without triggering typical security alerts associated with brute-force attacks or injection attempts.
To mitigate this risk, immediate action is required by upgrading MarketKing to a version newer than 2.1.60 where these access control issues have been addressed by the developers. Until an update is applied, administrators should implement compensating controls such as web application firewall rules that restrict access to sensitive endpoints based on user roles if possible through external configuration layers. Additionally, rigorous code review practices focusing on authorization logic for all API endpoints and administrative pages are essential to prevent similar issues in future development cycles. Regular security audits and penetration testing specifically targeting role-based access control mechanisms will help ensure that privilege boundaries remain intact against evolving threat landscapes.