CVE-2026-93342 in MarketKing Plugin
Summary
by MITRE • 09/22/2026
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification to copy any vendor's product listings, including private product metadata, and assign the duplicated copy to their own vendor account without the victim's knowledge or consent.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in MarketKing plugin for WordPress prior to version 2.1.72 represents a critical failure in access control mechanisms within the application logic governing product duplication operations. Specifically, the flaw resides in the marketking_duplicate_product AJAX action endpoint, which is designed to allow users to create copies of existing products. The core technical deficiency lies in the absence of proper authorization checks that verify whether the requesting user has ownership or administrative rights over the specific product being duplicated. Instead of validating the relationship between the authenticated user and the target resource identified by an arbitrary product ID supplied in the request parameters, the system proceeds with the duplication process based solely on the presence of a valid authentication token. This design oversight effectively neutralizes any intended restrictions that would limit this functionality to products owned by or associated with the requesting vendor account.
From a technical perspective, this vulnerability is classified under CWE-284, which describes Improper Access Control, and more specifically aligns with CWE-862, Missing Authorization. The attacker leverages this flaw by crafting HTTP requests that include valid credentials for an authenticated user with subscriber-level access or higher privileges. By manipulating the product ID parameter within these requests, the attacker can target any product in the database regardless of its ownership status. The system fails to perform a secondary check to ensure that the vendor associated with the authenticated session matches the vendor associated with the source product. Consequently, this allows for an unauthorized data flow where sensitive information and intellectual property are extracted from one entity's inventory and injected into another without any legitimate business justification or user consent.
The operational impact of this vulnerability is significant for multi-vendor e-commerce platforms relying on MarketKing to manage their marketplace operations. Attackers can systematically scrape product listings, including private metadata such as cost prices, supplier details, internal notes, and proprietary descriptions, by duplicating these items into their own vendor dashboards. This capability facilitates intellectual property theft and competitive espionage, allowing malicious actors to replicate successful products or steal confidential business data. Furthermore, the ability to duplicate any product undermines the integrity of the marketplace ecosystem, potentially leading to inventory conflicts, pricing discrepancies, and a degradation of trust among vendors who expect exclusive control over their listed items. The lack of audit trails for such unauthorized duplications further complicates forensic analysis and incident response efforts post-exploitation.
Mitigation strategies must focus on implementing robust server-side authorization checks within the marketking_duplicate_product AJAX handler. Developers should enforce strict ownership verification by querying the database to confirm that the authenticated user's vendor ID matches the product owner's ID before proceeding with any duplication logic. Additionally, applying the principle of least privilege ensures that even if an attacker gains access via a low-privilege account like subscriber, they are restricted from performing high-risk administrative or proprietary actions unless explicitly authorized. Upgrading to version 2.1.72 or later is essential as it addresses this specific authorization bypass. For environments where immediate patching is not feasible, implementing Web Application Firewall rules that monitor for anomalous patterns in AJAX requests targeting product duplication endpoints can provide a temporary layer of defense against exploitation attempts.