MarketKing EUVD-2026-84400

Requires an authenticated WordPress account of subscriber level or higher on a site running the MarketKing (Multivendor Marketplace for WooCommerce) plugin before version 2.1.72. The specific trigger is the marketking_admin_vendors_ajax AJAX action, which lacks a capability check, so any logged-in role can invoke it. Practical exploitability hinges on whether the target site permits self-service or open user registration (common on marketplace sites); if registration is closed or restricted, the attacker must first obtain a low-privilege account. No special server configuration, protocol, or non-default feature is needed beyond having the plugin installed and active. Impact is bounded to disclosure of the vendor directory (user IDs, usernames, email addresses) - no write, code execution, or availability impact.

This is a low-to-moderate real-world risk despite the vendor's CVSS 4.0 base of 7.1. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) correctly captures a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, but the VC:H (high confidentiality) rating overstates the impact: the exposed data is a directory of vendor user IDs, usernames, and email addresses - PII, but not credentials, secrets, or high-value data - so VC:L/C:L is more defensible. There is no integrity or availability impact (VI:N/VA:N), consistent with a pure information-disclosure/missing-authorization issue (CWE-862). No EPSS score, CISA KEV listing, or public POC was provided, so the exploitation status is 'no public exploit identified at time of analysis'; this is not conflicting data, simply absent enrichment. The flaw was reported by VulnCheck (a credible source) and a patch exists, but the requirement for an authenticated subscriber account plus the bounded, non-sensitive nature of the leaked data makes this a routine patch-on-cycle item rather than an emergency - priority is driven mainly by whether the site allows open subscriber registration.

An attacker registers a free subscriber-level account on a WordPress site running MarketKing (open registration is common on WooCommerce marketplaces), then sends a crafted request to the marketking_admin_vendors_ajax AJAX action. Because the action lacks a capability check, the server returns the full vendor directory - internal user IDs, usernames, and email addresses of every registered vendor - which the attacker can harvest for phishing or spam. No public exploit code was identified at time of analysis, but the request is trivial to craft given the low attack complexity.