MarketKing CVE-2026-85311

No special conditions - remote unauthenticated exploitation against default configurations of the MarketKing plugin (WordPress WooCommerce multivendor marketplace) through version 2.1.60. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms network-accessible exploitation requiring no credentials and no user interaction. Exploitation is limited to sites running MarketKing ≤2.1.60 on WordPress with WooCommerce; the integrity impact is partial (I:L) with no confidentiality or availability impact, and scope is unchanged (S:U), meaning the attacker cannot pivot to other system components via this flaw alone.

CVSS 5.3 Medium with AV:N/AC:L/PR:N/UI:N/S:U reflects a remotely exploitable, low-complexity flaw with no authentication required, but the impact ceiling is limited - C:N and A:N constrain the worst case to partial integrity modification (I:L). No KEV listing and no public POC are identified at time of analysis, lowering urgency relative to the attack vector breadth. For WordPress/WooCommerce multivendor marketplace operators, the real-world risk is moderate: unauthenticated actors could manipulate marketplace state, but cannot exfiltrate data or crash the service via this flaw alone. The absence of an exact patched version in the advisory data is a minor gap; defenders should upgrade beyond 2.1.60 and monitor Patchstack for confirmation.

An unauthenticated attacker sends a crafted HTTP request to a WordPress site running MarketKing ≤2.1.60, targeting an endpoint that lacks proper capability checks. Because the authorization check is absent, the request is processed and the attacker can modify marketplace state - such as altering vendor listings, product settings, or order data - without holding any account on the site. No public POC is identified at time of analysis.