CVE-2026-93343 in MarketKing Plugin
Summary
by MITRE • 09/22/2026
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request. Attackers can exploit the absence of capability checks in the vendor management action to retrieve internal user IDs, usernames, and email addresses of all registered vendors, exposing personally identifiable information to any logged-in user regardless of role.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified within MarketKing plugin versions prior to 2.1.72 represents a critical failure in access control mechanisms, specifically classified under CWE-862 as Missing Authorization. This flaw resides within the marketking_admin_vendors_ajax AJAX action handler, which is designed to manage vendor-related operations on WordPress sites utilizing this e-commerce solution. The core technical deficiency lies in the absence of proper capability checks or role-based verification before processing requests intended for administrative functions. In a secure implementation, actions that manipulate sensitive data such as user directories should be restricted to users with specific high-level privileges, typically administrator roles. However, due to this oversight, the endpoint fails to validate whether the requesting user possesses the necessary permissions to execute vendor management tasks or view comprehensive directory listings.
This architectural weakness allows authenticated attackers possessing subscriber-level access or higher to exploit the system by sending crafted AJAX requests. By leveraging standard WordPress authentication cookies and constructing a request that targets the vulnerable action parameter, an attacker can bypass intended restrictions without needing elevated privileges. The operational impact of this vulnerability is significant as it leads to the unauthorized disclosure of sensitive personally identifiable information. Specifically, attackers are able to retrieve the complete vendor directory from the database, which includes internal user IDs, usernames, and email addresses associated with all registered vendors on the platform. This exposure transforms a simple authentication bypass into a broader data privacy breach, potentially facilitating further attacks such as phishing campaigns or social engineering efforts against both vendors and site administrators.
From an offensive security perspective, this vulnerability aligns closely with MITRE ATT&CK technique T1078, specifically Valid Accounts, where attackers use legitimate credentials to access resources they are not authorized for. It also relates to CWE-200 as it involves the exposure of sensitive information to unauthorized actors. The ability to enumerate user accounts and extract email addresses provides a valuable reconnaissance vector that can be used in subsequent phases of an attack chain, such as credential stuffing or targeted spear-phishing attacks against high-value targets within the vendor community.
To mitigate this vulnerability, site administrators must immediately upgrade the MarketKing plugin to version 2.1.72 or later, where these authorization checks have been implemented and corrected. For organizations unable to patch immediately due to compatibility concerns with other plugins or custom code modifications, a temporary workaround involves restricting access to WordPress admin-ajax.php via web application firewall rules that block unauthorized AJAX calls targeting vendor management endpoints. Additionally, implementing strict role-based access control policies and regularly auditing plugin code for proper capability verification using functions like current_user_can can help prevent similar issues in future updates. Regular security assessments and penetration testing of custom or third-party plugins are essential to maintain the integrity of WordPress ecosystems against such authorization bypasses.