CVE-2026-93343: Missing Authorization in MarketKing WordPress Plugin Exposes Vendor Directory

Summary

CVE-2026-93343 is a high-severity missing authorization vulnerability in the MarketKing plugin for WordPress, affecting all versions before 2.1.72. The flaw resides in the marketking_admin_vendors_ajax AJAX action, which lacks proper capability checks. This allows any authenticated user with subscriber-level access or higher to retrieve the complete vendor directory, exposing internal user IDs, usernames, and email addresses of all registered vendors on the marketplace.

Technical Analysis

The MarketKing plugin is a multivendor marketplace extension for WooCommerce that enables vendors to sell products through a WordPress-powered storefront. As part of its administrative functionality, the plugin registers an AJAX handler identified as marketking_admin_vendors_ajax. This action is designed to return vendor directory data to authorized administrative users for management purposes within the WordPress dashboard.

The core problem is classified under CWE-862, which describes missing authorization. In WordPress plugin development, AJAX actions registered through the WordPress AJAX API should enforce capability checks using functions such as current_user_can() to verify that the requesting user holds the appropriate role or capability before processing the request. In this case, the marketking_admin_vendors_ajax handler does not perform such a check before returning vendor data.

Because the action is accessible to authenticated users, any logged-in account, including those with the lowest privilege level of subscriber, can invoke the AJAX endpoint and receive the full vendor directory response. The response includes personally identifiable information such as internal WordPress user IDs, usernames, and email addresses associated with each registered vendor account.

The CVSS 4.0 base score for this vulnerability is 7.1, rated as high severity. The vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N indicates that the vulnerability is exploitable over the network with low attack complexity, requires no user interaction, and demands only low privileges (any authenticated account). The vulnerability confidentiality impact is high, meaning sensitive information is fully exposed, while integrity and availability impacts are rated as none.

It is important to note that this is not an unauthenticated vulnerability. The attacker must possess at least a subscriber-level account on the target WordPress site. However, subscriber is the default lowest-privilege role in WordPress, and many sites allow open registration or have large numbers of low-privilege accounts, making the effective attack surface broader than it might initially appear.

Affected Software and Versions

Product: MarketKing plugin for WordPress
Vendor: MarketKing
Affected versions: All versions before 2.1.72
Fixed version: 2.1.72

The vulnerability was addressed in version 2.1.72 of the MarketKing plugin. Site administrators running any version prior to 2.1.72 should update immediately to eliminate the exposure.

Impact

The primary impact of CVE-2026-93343 is the unauthorized disclosure of personally identifiable information belonging to all registered vendors on an affected WordPress marketplace. Specifically, an attacker who successfully exploits this vulnerability can obtain:

Internal WordPress user IDs of all registered vendors, which can be used as a stepping stone for further attacks targeting specific user accounts.
Usernames of all vendor accounts, which can be leveraged in credential stuffing or brute-force attacks against the login system.
Email addresses of all vendors, which represent sensitive personally identifiable information that could be used for phishing campaigns, social engineering, or sold to third parties.

The exposure of a complete vendor directory is particularly damaging for multivendor marketplaces, where the vendor list may represent a competitive asset or contain contact information for business partners. An attacker could use the harvested email addresses to conduct targeted phishing campaigns against vendors, potentially compromising vendor accounts and gaining access to product listings, payout settings, or customer order data.

Additionally, the disclosure of internal user IDs can facilitate further enumeration attacks. With knowledge of valid user IDs and usernames, an attacker may attempt to exploit other vulnerabilities or misconfigurations that accept user identifiers as input, such as REST API endpoints or other AJAX actions that may have incomplete authorization checks.

From a compliance perspective, the unauthorized disclosure of email addresses and usernames may constitute a personal data breach under regulations such as the GDPR, depending on the jurisdiction and the nature of the data exposed. Site operators may have notification obligations to affected individuals and regulatory authorities.

Exploitation Scenario

To exploit CVE-2026-93343, an attacker must first obtain authenticated access to the target WordPress site at the subscriber level or higher. This can occur through several realistic scenarios:

Open registration: Many WordPress sites enable user registration by default or through configuration. If registration is open, an attacker can simply create a new subscriber account and immediately gain the minimum required access.
Existing low-privilege accounts: On sites with a large user base, such as membership sites or e-commerce platforms where customers create accounts during checkout, an attacker may already possess or can easily obtain a customer-level account, which typically has permissions equal to or greater than subscriber.
Compromised low-privilege credentials: An attacker who has obtained credentials for any low-privilege account through phishing, credential stuffing, or other means can leverage that access to exploit this vulnerability.

Once authenticated, the attacker sends a crafted AJAX request to the WordPress AJAX endpoint targeting the marketking_admin_vendors_ajax action. Because the handler does not verify the user’s capabilities, the server processes the request and returns the vendor directory data regardless of the user’s role. The attacker receives a response containing the user IDs, usernames, and email addresses of all registered vendors on the marketplace.

The attack is relatively simple to execute, requiring only a valid authenticated session and knowledge of the AJAX action name. No special tools or advanced techniques are needed beyond a standard web browser or HTTP client capable of sending authenticated requests to the WordPress AJAX endpoint.

Detection and Mitigation

Detection

Site administrators should review WordPress access logs and server logs for requests targeting the marketking_admin_vendors_ajax AJAX action. In WordPress, AJAX requests are typically sent to the /wp-admin/admin-ajax.php endpoint with the action name included in the POST body or query string. Look for requests to this endpoint that include action=marketking_admin_vendors_ajax originating from user accounts that should not have administrative access.

Additionally, administrators can audit user accounts on the site to identify any unexpected subscriber or customer accounts that may have been created for reconnaissance purposes. A sudden spike in new account registrations, particularly from suspicious IP addresses or email domains, may indicate an attacker preparing to exploit this or similar vulnerabilities.

Mitigation

Update immediately: The most effective mitigation is to update the MarketKing plugin to version 2.1.72 or later, which includes the fix for this vulnerability. Check the plugin changelog for details on the fix.
Restrict user registration: If user registration is not required for the site’s functionality, disable it in WordPress settings under Settings > General by unchecking the option for anyone to register. If registration is necessary, consider using a registration approval workflow or CAPTCHA to reduce automated account creation.
Review user roles: Audit existing user accounts and remove or downgrade any accounts that do not require access. Ensure that subscriber and customer accounts have the minimum necessary capabilities.
Monitor AJAX activity: Implement logging or monitoring for AJAX requests to sensitive administrative actions, particularly those that return user data or directory listings.
Apply Web Application Firewall rules: A WAF may help detect and block suspicious AJAX requests from low-privilege users targeting administrative endpoints, though this should be considered a complementary control rather than a replacement for the plugin update.

Bug Bounty Angle

CVE-2026-93343 represents a class of vulnerability that is highly relevant to bug bounty hunters and security researchers focused on WordPress plugin security. Missing authorization in AJAX actions is one of the most common vulnerability patterns in WordPress plugins, and this case provides a clear example of how a failure to implement capability checks can lead to information disclosure.

For researchers testing WordPress plugins, the following methodology is relevant:

Enumerate AJAX actions: Review the plugin source code to identify all registered AJAX actions using add_action('wp_ajax_...') and add_action('wp_ajax_nopriv_...') hooks. For each action, verify whether a capability check is performed before processing.
Test with low-privilege accounts: Create or use a subscriber-level account to test each AJAX action. If an action intended for administrative use returns data or performs operations without checking capabilities, it may be vulnerable.
Focus on data-returning actions: AJAX actions that return lists of users, orders, products, or other sensitive data are high-value targets for missing authorization vulnerabilities, as the impact is immediate and measurable.

The CVSS score of 7.1 and the high severity rating reflect the real-world impact of this vulnerability. Bug bounty programs that cover WordPress plugin vulnerabilities, particularly those offered by plugin vendors or marketplace platforms, should consider missing authorization flaws in AJAX handlers as in-scope and worthy of meaningful rewards.

Researchers should also consider the downstream impact of vendor directory exposure. The ability to enumerate all vendor email addresses on a marketplace can facilitate further attacks, and this chain of impact should be documented in vulnerability reports to justify appropriate severity ratings.

Frequently Asked Questions

What is CVE-2026-93343?

CVE-2026-93343 is a missing authorization vulnerability in the MarketKing plugin for WordPress before version 2.1.72. The marketking_admin_vendors_ajax AJAX action lacks capability checks, allowing authenticated users with subscriber-level access or higher to retrieve the complete vendor directory including user IDs, usernames, and email addresses.

Who can exploit this vulnerability?

Any authenticated WordPress user with subscriber-level access or higher can exploit this vulnerability. The attacker must have a valid account on the target site, but the subscriber role is the lowest default privilege level in WordPress, making the attack feasible on sites with open registration or large user bases.

How do I fix this vulnerability?

Update the MarketKing plugin to version 2.1.72 or later. This version includes the fix that adds proper authorization checks to the marketking_admin_vendors_ajax action. Site administrators should also review whether user registration is necessary and restrict it if possible.