MarketKing EUVD-2026-84401

Requires an authenticated account of subscriber-level or higher on a WordPress site running the MarketKing multi-vendor marketplace plugin (before 2.1.72) configured as an active marketplace with multiple vendors holding financial/payout data. Exploitation is a single parameter-tampering request to the marketking_get_page_content AJAX action supplying an arbitrary vendor user ID; no user interaction from a victim is needed. Limiting factors: the attacker must hold a valid low-privilege session (PR:L), the site must have the plugin installed and populated with vendor accounts worth targeting, and impact is confined to reading vendor data (confidentiality only) - no modification or denial of service is possible.

This is a genuine but bounded authorization flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, base 7.1) tells a consistent story: remotely reachable, low complexity, but requires an authenticated account (PR:L - subscriber-level or higher) and yields confidentiality impact only (no integrity or availability effect). The description matches - it is an IDOR-style missing authorization (CWE-862) where a low-privileged authenticated user swaps a vendor user ID to read other vendors' payout, financial-report, and dashboard pages. There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the input, so exploitation status is: no public exploit identified at time of analysis. The single most important gating factor is the PR:L requirement plus the need for the site to actually be running MarketKing as a multi-vendor marketplace with real vendor data - this keeps real-world risk moderate rather than critical despite the 7.1 score. VulnCheck (a credible source) reported it and a vendor patch exists, which raises confidence the flaw is real. Note the VC:H rating is arguably generous for exposure of marketplace vendor financial pages rather than site-wide secrets; my independent read is C:H is defensible because per-vendor financial/payout data is sensitive, but reasonable analysts could rate it C:L.

An attacker registers or obtains any subscriber-level account on a WordPress site running MarketKing as a multi-vendor marketplace. They send a marketking_get_page_content AJAX request substituting an arbitrary target vendor user ID, and the server returns that vendor's payout pages, financial reports, and dashboard content without verifying the requester owns that vendor account. No public exploit code was provided in the input, but the attack is a trivial parameter-tampering request requiring only a valid low-privilege session.