CVE-2026-93344 Details
Description
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor user ID. Attackers can bypass authorization controls by submitting a target vendor ID in the request to access payout pages, financial reports, and vendor dashboard content belonging to any vendor in the marketplace.
A missing authorization vulnerability has been identified in the MarketKing plugin for WordPress, affecting versions prior to 2.1.72. The vulnerability resides in the 'marketking_get_page_content' AJAX action, where authenticated attackers with subscriber-level access or higher can access arbitrary vendor administrator panel pages. By supplying a specific vendor user ID, attackers can bypass authorization controls to access payout pages, financial reports, and vendor dashboard content for any vendor in the marketplace.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MarketKing | < 2.1.72 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | New CVE Received | [email protected] |
| Sep 22, 2026 | CVE Modified | CISA-ADP |