What is the CVSS score of EUVD-2026-48157?

EUVD-2026-48157 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

MarketKing EUVD-2026-48157

| CVE-2026-27399 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-4j53-6r5m-fjwf

WordPress Authentication Bypass Wordpress Plugin Marketking Webwizards

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network exploitation confirmed; no confidentiality or availability impact; integrity limited to plugin-scope unauthorized actions.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:03 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.

AnalysisAI

Broken access control in MarketKing (WooCommerce multivendor marketplace plugin) version 2.1.40 and earlier allows unauthenticated remote attackers to perform unauthorized marketplace actions without valid credentials. The flaw stems from missing authorization checks (CWE-862), enabling integrity-impacting operations against affected WordPress/WooCommerce installations. No public exploit code or active exploitation has been identified at time of analysis, and the impact is constrained to integrity (I:L), with no confidentiality or availability consequences.

Technical ContextAI

MarketKing (CPE: cpe:2.3:a:webwizards:marketking:*:*:*:*:*:*:*:*) is a WooCommerce extension that enables multivendor marketplace functionality on WordPress. CWE-862 (Missing Authorization) indicates the plugin fails to enforce proper capability or nonce checks before executing privileged actions - a common pattern in WordPress plugins where AJAX handlers or REST endpoints are registered without verifying the requesting user's role or permissions. In a multivendor context, insufficiently guarded endpoints could expose vendor management, product listing, or order-processing functionality to unauthenticated callers. The vulnerability was disclosed by Patchstack, a WordPress-focused security intelligence platform known for coordinated disclosure with plugin authors.

RemediationAI

Update MarketKing to a version released after 2.1.40 - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/marketking-multivendor-marketplace-for-woocommerce/vulnerability/wordpress-marketking-plugin-2-1-40-broken-access-control-vulnerability should be consulted for the confirmed patched version, which was not independently specified in the available intelligence. If an update is not immediately available or deployable, consider temporarily deactivating the MarketKing plugin to eliminate exposure, accepting the trade-off of lost marketplace functionality during the mitigation window. Alternatively, restrict public access to the WordPress installation via IP allowlisting at the server or WAF layer if the marketplace is not intended for public-facing unauthenticated traffic. Monitor WordPress admin logs and WooCommerce order or product activity for anomalous unauthenticated actions as a detective control.