Marketking
Monthly
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (before 2.1.72) lets any authenticated user with subscriber-level access or higher read other vendors' payout pages, financial reports, and dashboard content by submitting an arbitrary vendor user ID to the marketking_get_page_content AJAX action. Exploitation is a single parameter-tampering request over the network with no victim interaction, but it requires a valid low-privilege session on a site that runs the plugin as an active marketplace with vendor accounts holding financial data, as reflected in the assessed CVSS vector (PR:L, UI:N). Impact is limited to confidentiality - no modification or denial of service is possible - and no public exploit code has been identified at time of analysis; the vendor has released a fix in 2.1.72.
Authenticated subscriber-level users can retrieve the complete vendor directory from WordPress sites running MarketKing before 2.1.72 by invoking the marketking_admin_vendors_ajax AJAX action, which lacks a capability check. This exposes internal user IDs, usernames, and email addresses of all registered vendors to any logged-in user, making it a personally identifiable information disclosure issue rather than code execution or data modification. No public exploit identified at time of analysis, and the independent assessment rates real-world risk as low-to-moderate because exploitation requires an account, though open registration on marketplace sites can lower that barrier.
Unauthenticated broken access control in MarketKing (Multivendor Marketplace for WooCommerce) 2.1.70 and earlier allows remote attackers to invoke a privileged plugin action without any authorization check, resulting in unauthorized integrity changes on affected WordPress sites. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no credentials or user interaction are required but the impact is confined to low-integrity modification with no confidentiality or availability effect. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; risk is further limited because the description does not identify the specific unprotected endpoint, so an attacker must first discover it, and the plugin is a niche commercial marketplace add-on with limited deployment.
Duplicate and misappropriate other vendors' product listings in the MarketKing WordPress plugin before 2.1.72 by exploiting a missing authorization check in the marketking_duplicate_product AJAX action; this requires only subscriber-level access or higher and lets the attacker assign copied products, including private metadata, to their own vendor account. The vulnerability is remotely exploitable but low impact (confidentiality and integrity only, no availability impact), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released version 2.1.72 as a fix.
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (versions before 2.1.72) allows any authenticated user with subscriber-level access or higher to file refund requests against arbitrary orders through the marketking_send_refund AJAX action, simply by supplying someone else's order ID. The flaw is rated CVSS 5.3 / CVSS:3.1 5.3 (AV:N/AC:L/PR:L/UI:N, integrity-only impact) because the attacker needs a valid low-privilege session - a bar that is low on marketplace sites that permit open user self-registration - but gains no data disclosure or privilege escalation. Exploitation is bounded to creating spurious refund requests and marketplace disruption; there is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and a vendor patch is available in 2.1.72.
Missing Authorization in MarketKing WordPress plugin (≤2.1.60) allows unauthenticated remote attackers to perform integrity-affecting actions by exploiting incorrectly configured access control security levels. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required. No public exploit or CISA KEV listing identified at time of analysis; impact is limited to partial integrity (C:N/A:N) per CVSS.
Broken access control in MarketKing (WooCommerce multivendor marketplace plugin) version 2.1.40 and earlier allows unauthenticated remote attackers to perform unauthorized marketplace actions without valid credentials. The flaw stems from missing authorization checks (CWE-862), enabling integrity-impacting operations against affected WordPress/WooCommerce installations. No public exploit code or active exploitation has been identified at time of analysis, and the impact is constrained to integrity (I:L), with no confidentiality or availability consequences.
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (before 2.1.72) lets any authenticated user with subscriber-level access or higher read other vendors' payout pages, financial reports, and dashboard content by submitting an arbitrary vendor user ID to the marketking_get_page_content AJAX action. Exploitation is a single parameter-tampering request over the network with no victim interaction, but it requires a valid low-privilege session on a site that runs the plugin as an active marketplace with vendor accounts holding financial data, as reflected in the assessed CVSS vector (PR:L, UI:N). Impact is limited to confidentiality - no modification or denial of service is possible - and no public exploit code has been identified at time of analysis; the vendor has released a fix in 2.1.72.
Authenticated subscriber-level users can retrieve the complete vendor directory from WordPress sites running MarketKing before 2.1.72 by invoking the marketking_admin_vendors_ajax AJAX action, which lacks a capability check. This exposes internal user IDs, usernames, and email addresses of all registered vendors to any logged-in user, making it a personally identifiable information disclosure issue rather than code execution or data modification. No public exploit identified at time of analysis, and the independent assessment rates real-world risk as low-to-moderate because exploitation requires an account, though open registration on marketplace sites can lower that barrier.
Unauthenticated broken access control in MarketKing (Multivendor Marketplace for WooCommerce) 2.1.70 and earlier allows remote attackers to invoke a privileged plugin action without any authorization check, resulting in unauthorized integrity changes on affected WordPress sites. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no credentials or user interaction are required but the impact is confined to low-integrity modification with no confidentiality or availability effect. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; risk is further limited because the description does not identify the specific unprotected endpoint, so an attacker must first discover it, and the plugin is a niche commercial marketplace add-on with limited deployment.
Duplicate and misappropriate other vendors' product listings in the MarketKing WordPress plugin before 2.1.72 by exploiting a missing authorization check in the marketking_duplicate_product AJAX action; this requires only subscriber-level access or higher and lets the attacker assign copied products, including private metadata, to their own vendor account. The vulnerability is remotely exploitable but low impact (confidentiality and integrity only, no availability impact), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released version 2.1.72 as a fix.
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (versions before 2.1.72) allows any authenticated user with subscriber-level access or higher to file refund requests against arbitrary orders through the marketking_send_refund AJAX action, simply by supplying someone else's order ID. The flaw is rated CVSS 5.3 / CVSS:3.1 5.3 (AV:N/AC:L/PR:L/UI:N, integrity-only impact) because the attacker needs a valid low-privilege session - a bar that is low on marketplace sites that permit open user self-registration - but gains no data disclosure or privilege escalation. Exploitation is bounded to creating spurious refund requests and marketplace disruption; there is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and a vendor patch is available in 2.1.72.
Missing Authorization in MarketKing WordPress plugin (≤2.1.60) allows unauthenticated remote attackers to perform integrity-affecting actions by exploiting incorrectly configured access control security levels. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required. No public exploit or CISA KEV listing identified at time of analysis; impact is limited to partial integrity (C:N/A:N) per CVSS.
Broken access control in MarketKing (WooCommerce multivendor marketplace plugin) version 2.1.40 and earlier allows unauthenticated remote attackers to perform unauthorized marketplace actions without valid credentials. The flaw stems from missing authorization checks (CWE-862), enabling integrity-impacting operations against affected WordPress/WooCommerce installations. No public exploit code or active exploitation has been identified at time of analysis, and the impact is constrained to integrity (I:L), with no confidentiality or availability consequences.