MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution, CVE-2026-93344
- CVE, Research URL
- Home page URL
-
Security reports for MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
- Published on
- Sep 22, 2026
- Research Description
- MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor user ID. Attackers can bypass authorization controls by submitting a target vendor ID in the request to access payout pages, financial reports, and vendor dashboard content belonging to any vendor in the marketplace.
- Affected versions
-
max 2.1.72.
- Status
-
vulnerable