MarketKing EUVD-2026-84398

Requires an authenticated account with subscriber-level access or higher on a WordPress site running the MarketKing multivendor marketplace plugin (before version 2.1.72) with the vendor/product-duplication feature present. The attacker must be able to reach the marketking_duplicate_product AJAX endpoint and supply an arbitrary product ID; no victim interaction, no admin privileges, and no non-default configuration beyond having the plugin active are needed. Exploitation is limited by the need to hold a valid low-privilege account and by the bounded impact - it copies product listings and private product metadata but does not grant account takeover or code execution.

This is a low-to-medium real-world risk despite the network attack vector. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, base 5.3) is internally consistent with the CWE-862 missing-authorization description: PR:L reflects the required subscriber-level (or higher) account, and the low confidentiality/integrity impacts (VC:L/VI:L) match a bounded outcome - copying another vendor's product data and metadata rather than full account or site compromise. There is no availability impact (VA:N) and no scope/subsequent-system impact. No EPSS score, KEV listing, or POC is present in the input, so exploitation is 'no public exploit identified at time of analysis'; the absence of KEV plus a bounded, business-logic-style impact means this is not an urgent priority. The one signal that raises priority slightly is that a patch is available (v2.1.72) and the report comes from VulnCheck, a credible source, so defenders can and should remediate cleanly. No conflicting signals between the vector and the description were identified - both point to authenticated, remote, low-complexity abuse with limited impact.

An attacker registers or already holds a low-privilege account (subscriber, or a vendor account) on a MarketKing-powered multivendor store, then sends a crafted marketking_duplicate_product AJAX request supplying a competitor's product ID. Because ownership is never verified, the server duplicates the target vendor's listing - including private product metadata - and assigns the copy to the attacker's own vendor account. No public exploit code is identified in the provided data, but the request is trivial to construct given low attack complexity.