MarketKing EUVD-2026-84396

Requires the MarketKing multivendor plugin (before 2.1.72) installed on a WooCommerce site AND an authenticated account of subscriber level or higher - commonly obtainable via open WordPress user self-registration on marketplace sites. The attacker must reach the marketking_send_refund AJAX action (admin-ajax.php) and supply an arbitrary order ID; no user interaction from a victim and no admin privileges are needed. Exploitation is LIMITED by the requirement for a valid low-privilege session and is bounded to creating spurious refund requests (integrity impact only) - it does not expose order data or grant elevated access. Sites that disable open registration substantially raise the bar.

This is a low-to-moderate real-world risk despite the network attack vector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms remote exploitation with low complexity and no user interaction, but requires authentication (PR:L, subscriber-level or higher) and the only impact is limited integrity (VI:L) - confidentiality (VC:N) and availability (VA:N) are unaffected, with no scope change. The vendor score of 5.3 is impact-bounded: the flaw only lets an attacker create fraudulent/spurious refund requests, not read data, take over accounts, or execute code. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation - this reads as a data-integrity/business-logic nuisance rather than an urgent priority. The primary caveat is that WordPress sites frequently allow open self-registration, which effectively lowers the PR:L barrier to near-unauthenticated in practice; defenders on marketplaces with open subscriber registration should weight this higher. No key signals are contradictory: the CVSS vector, description (authenticated IDOR-style missing authorization), and CWE-862 are all consistent.

An attacker registers a free subscriber-level account (or uses any existing low-privilege account) on a WooCommerce marketplace running MarketKing. They then send a crafted AJAX request to the marketking_send_refund action supplying an arbitrary order ID belonging to another customer, causing a fraudulent refund request to be filed against an order they never placed. Repeating this across enumerated order IDs disrupts vendors and customers and pollutes the marketplace's refund workflow. No public exploit code was identified at time of analysis.