EUVD-2026-108030
GHSA-g5mj-qhrm-784p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain low-privilege marketplace account
-
ExploitSend crafted request to unprotected endpoint
-
ExecutionBypass missing authorization check
-
ImpactAccess or modify other vendors' data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privilege account on the WordPress/WooCommerce site running MarketKing (versions up to and including 2.1.72) - per PR:L, this is not reachable by fully unauthenticated attackers. Once authenticated, no special non-default configuration or user interaction is needed (AC:L/UI:N), and the vulnerable marketplace is network-reachable. Limiting factors: the attacker must first obtain a valid account (e.g., vendor/customer self-registration must be enabled), impact is bounded to limited confidentiality and integrity with no availability effect, and the site must be running the affected MarketKing plugin version. |
| Impact | Signals point to a moderate, authenticated access-control flaw rather than a top-tier priority. The CVSS 3.1 base of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) describes network-reachable, low-complexity exploitation that nonetheless REQUIRES an existing low-privilege account (PR:L), with only limited confidentiality and integrity impact and no availability impact - consistent with a CWE-862 Missing Authorization issue where an authenticated actor reaches functions or data they should not. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor-side signal (Patchstack audit submission) confirms the flaw is real and triaged, but the absence of KEV/POC/EPSS data means real-world exploitation likelihood is currently unquantified. Net: a genuine but mid-severity, authentication-gated marketplace bug - worth patching in normal cycles, not an emergency, barring new exploitation data. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege account on the marketplace (for example a registered vendor or customer) sends crafted authenticated requests to a MarketKing endpoint that fails to verify authorization, reaching vendor or order data or actions belonging to other users. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, this is a straightforward remote request with no victim interaction, but it depends on first obtaining a valid account. No public exploit code is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress/WooCommerce through 2.1.72 allows an authenticated low-privilege account to perform marketplace actions beyond its intended permissions, affecting limited confidentiality and integrity (CVSS 5.4, CWE-862). The flaw is network-reachable and requires only a valid low-privilege account, so sites that allow vendor or customer self-registration have broader exposure. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
RemediationAI
The provided intelligence does not list an exact fixed version; upgrade MarketKing to a release later than 2.1.72 once the vendor/Patchstack advisory confirms it is patched, and verify the installed plugin version after updating. Until a fixed release is confirmed, reduce exposure by disabling open vendor/customer self-registration or requiring administrator approval for new accounts (trade-off: onboarding friction and manual review), restricting low-privilege accounts to trusted users (trade-off: operational overhead), and disabling the marketplace plugin if it is not required (trade-off: loss of marketplace functionality). Consider a WAF/virtual patch for the affected marketplace endpoints if your platform can identify them, but treat that as temporary because the exact vulnerable action is not named in the supplied data; monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/marketking-multivendor-marketplace-for-woocommerce/vulnerability/wordpress-marketking-plugin-2-1-72-broken-access-control-vulnerability?_s_id=cve for updated fix information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MarketKing is a WordPress plugin that adds multivendor marketplace capabilities to WooCommerce, exposing vendor/customer roles and marketplace operations. The root cause is CWE-862 (Missing Authorization): the plugin fails to enforce an authorization check, such as a WordPress capability or ownership check, on at least one marketplace function, allowing a low-privilege authenticated user to invoke it. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N confirms network reachability, low attack complexity, no user interaction, and limited confidentiality/integrity impact; PR:L means the attacker needs a valid low-privilege account, and the supplied data does not identify the exact vulnerable action or endpoint. The Patchstack tag "Authentication Bypass" should be read in that authenticated context; no public exploit code or CISA KEV entry was provided.
Know when Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Missing authorization reachable over the network by any logged-in low-privilege user (PR:L, AC:L, UI:N); limited cross-account read/write gives C:L/I:L, no availability impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
Unauthenticated remote code execution in Print Invoice & Delivery Notes for WooCommerce through 5.8.0 lets remote attack
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to a
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Unauthenticated path traversal in OrderConvo (the "Admin and Customer Messages After Order for WooCommerce" plugin), aff
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execu
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
Exploit-DB