EUVD-2026-84396
GHSA-j68h-v872-356w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister/authenticate as subscriber
-
DeliveryEnumerate arbitrary order IDs
-
ExploitSend crafted marketking_send_refund AJAX request
-
ExecutionCreate fraudulent refund requests against others' orders
-
ImpactMarketplace disruption and data integrity loss
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the MarketKing multivendor plugin (before 2.1.72) installed on a WooCommerce site AND an authenticated account of subscriber level or higher - commonly obtainable via open WordPress user self-registration on marketplace sites. The attacker must reach the marketking_send_refund AJAX action (admin-ajax.php) and supply an arbitrary order ID; no user interaction from a victim and no admin privileges are needed. Exploitation is LIMITED by the requirement for a valid low-privilege session and is bounded to creating spurious refund requests (integrity impact only) - it does not expose order data or grant elevated access. Sites that disable open registration substantially raise the bar. |
| Impact | This is a low-to-moderate real-world risk despite the network attack vector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms remote exploitation with low complexity and no user interaction, but requires authentication (PR:L, subscriber-level or higher) and the only impact is limited integrity (VI:L) - confidentiality (VC:N) and availability (VA:N) are unaffected, with no scope change. The vendor score of 5.3 is impact-bounded: the flaw only lets an attacker create fraudulent/spurious refund requests, not read data, take over accounts, or execute code. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation - this reads as a data-integrity/business-logic nuisance rather than an urgent priority. The primary caveat is that WordPress sites frequently allow open self-registration, which effectively lowers the PR:L barrier to near-unauthenticated in practice; defenders on marketplaces with open subscriber registration should weight this higher. No key signals are contradictory: the CVSS vector, description (authenticated IDOR-style missing authorization), and CWE-862 are all consistent. |
| Exploit ScenarioDerived | An attacker registers a free subscriber-level account (or uses any existing low-privilege account) on a WooCommerce marketplace running MarketKing. They then send a crafted AJAX request to the marketking_send_refund action supplying an arbitrary order ID belonging to another customer, causing a fraudulent refund request to be filed against an order they never placed. Repeating this across enumerated order IDs disrupts vendors and customers and pollutes the marketplace's refund workflow. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (versions before 2.1.72) allows any authenticated user with subscriber-level access or higher to file refund requests against arbitrary orders through the marketking_send_refund AJAX action, simply by supplying someone else's order ID. The flaw is rated CVSS 5.3 / CVSS:3.1 5.3 (AV:N/AC:L/PR:L/UI:N, integrity-only impact) because the attacker needs a valid low-privilege session - a bar that is low on marketplace sites that permit open user self-registration - but gains no data disclosure or privilege escalation. Exploitation is bounded to creating spurious refund requests and marketplace disruption; there is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and a vendor patch is available in 2.1.72.
RemediationAI
Vendor-released patch: 2.1.72 - update the MarketKing plugin to 2.1.72 or later through the WordPress plugin dashboard or by downloading the current release from the WordPress.org plugin page, then verify the installed version against the vendor changelog at https://marketkingplugin.com/changelog/. Where immediate upgrading is not possible, the most effective compensating control is to close the low-privilege entry path: disable open user self-registration (Settings > General) or gate it behind email verification/approval, accepting that this blocks legitimate marketplace signups and new vendor onboarding. A WAF or reverse-proxy rule that blocks or rate-limits POSTs to wp-admin/admin-ajax.php carrying the action=marketking_send_refund parameter for non-privileged roles will stop the attack pattern, but it may also break legitimate refund submissions by vendors and customers, so it should be scoped and monitored before being left in place. Additionally, ensure all plugins and the WordPress core are current, review the refund-request queue for spurious entries created by low-privilege accounts, and audit any third-party modules that wrap or override the MarketKing refund flow, since they may reintroduce the same missing authorization check.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MarketKing is a multivendor marketplace extension that runs on top of WooCommerce, adding vendor storefronts, order routing, and refund workflows. The vulnerable endpoint is the WordPress AJAX action marketking_send_refund, dispatched through wp-admin/admin-ajax.php, which is reachable by any logged-in user because admin-ajax.php does not itself enforce capability checks. The root cause class is CWE-862 (Missing Authorization): the handler fails to verify both that the caller holds a capability appropriate to the refund operation and that the caller owns or is otherwise entitled to act on the supplied order ID, so the order identifier in the request is effectively trusted. WordPress hardening guidance requires AJAX handlers to combine a nonce check (to prevent request forgery) with an explicit current_user_can() capability test scoped to the specific order object - the equivalent of an object-level authorization check in a REST context. Because only the order ID is attacker-controlled and no other parameters are needed, the weakness is trivially automatable with a single crafted POST, but its effect is confined to writing a new refund request record. The CPE cpe:2.3:a:webwizards:marketking:*:*:*:*:*:*:*:* identifies the WebWizards-published MarketKing package without pinning an explicit version range in the CPE itself; the authoritative affected range comes from the vendor changelog and the description (all versions before 2.1.72).
Know when Marketking gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Remote AJAX endpoint (AV:N/AC:L), requires an authenticated subscriber account (PR:L), no user interaction; impact is limited to creating bogus refund records (I:L) with no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers can submit crafted AJAX requests targeting any order ID to create fraudulent refund requests against orders they did not place, enabling marketplace disruption and unauthorized interference with other users' orders.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Marketking
View allAuthenticated subscriber-level users can retrieve the complete vendor directory from WordPress sites running MarketKing
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (before 2.1.72) lets any authentica
Duplicate and misappropriate other vendors' product listings in the MarketKing WordPress plugin before 2.1.72 by exploit
Broken access control in MarketKing (WooCommerce multivendor marketplace plugin) version 2.1.40 and earlier allows unaut
Missing Authorization in MarketKing WordPress plugin (≤2.1.60) allows unauthenticated remote attackers to perform integr
Unauthenticated broken access control in MarketKing (Multivendor Marketplace for WooCommerce) 2.1.70 and earlier allows
Exploit-DB