MarketKing EUVD-2026-48157

The MarketKing plugin (version <= 2.1.40) must be installed and active on a WordPress site running WooCommerce. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no special network positioning, no user interaction, and no elevated configuration is required - exploitation is possible against any publicly reachable WordPress instance with the plugin enabled in its default state. Limiting factors include: impact is integrity-only with no confidentiality or availability consequence, no confidential data exposure is expected, and the scope is unchanged (S:U), meaning exploitation does not enable escalation to broader WordPress admin or server compromise. Sites that are not public-facing or that have WAF rules blocking anomalous WordPress AJAX/REST requests have reduced exposure.

The CVSS 3.1 score of 5.3 (Medium) reflects a network-reachable, low-complexity, unauthenticated vector with limited integrity impact and no confidentiality or availability consequences. The S:U (unchanged scope) and I:L metrics suggest the impact is bounded within the plugin's own data or functionality rather than enabling full site compromise or lateral movement. No EPSS data was provided in the intelligence, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. No POC is referenced. Despite the unauthenticated nature (PR:N, UI:N), the absence of confidentiality impact significantly reduces urgency compared to broken access control flaws that expose sensitive data. The primary real-world risk is unauthorized modification of marketplace content - product listings, vendor settings, or order states - which could disrupt marketplace operations. This is a genuine but non-critical priority: patch promptly, but not an emergency requiring immediate out-of-band response.

An unauthenticated attacker identifies a WordPress site running MarketKing <= 2.1.40 - discoverable via the plugin's public readme or generator tags. The attacker sends a crafted HTTP request to an unprotected AJAX handler or endpoint exposed by the plugin, bypassing the missing authorization check to perform a privileged marketplace action such as modifying a vendor's product listing or order status. No credentials or user interaction are required, making this trivially automatable against any exposed WordPress installation running the vulnerable plugin.