CVE-2024-12413 Overview
The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress contains a missing authorization vulnerability [CWE-862]. All versions up to and including 2.0.00 fail to perform capability checks on multiple sensitive functions, including marketking_delete_team_member, marketkingrejectuser, and marketking_save_profile_settings. Unauthenticated attackers can invoke these functions over the network to delete users, approve users, and modify plugin settings. The weakness affects the integrity of marketplace data without requiring authentication or user interaction.
Critical Impact
Unauthenticated remote attackers can delete marketplace users, approve pending vendors, and alter profile settings on WordPress sites running vulnerable MarketKing installations.
Affected Products
- MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress
- All versions up to and including 2.0.00
- WordPress sites running WooCommerce with MarketKing installed
Discovery Timeline
- 2024-12-25 - CVE-2024-12413 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12413
Vulnerability Analysis
The vulnerability is a missing authorization flaw in the MarketKing plugin's AJAX action handlers. Multiple server-side functions, including marketking_delete_team_member, marketkingrejectuser, and marketking_save_profile_settings, execute privileged operations without verifying the caller's capability or role. The plugin registers these handlers through WordPress AJAX endpoints that remain reachable without authentication. An attacker can therefore send crafted HTTP requests to admin-ajax.php and trigger administrative state changes.
The fix landed in WordPress plugin changeset 3212032, which added capability checks to the affected functions in class-marketking-core.php.
Root Cause
The root cause is the absence of current_user_can() capability checks and nonce verification inside the plugin's AJAX handlers. WordPress exposes wp_ajax_ and wp_ajax_nopriv_ hooks that execute attached callbacks when requested. Registering sensitive functions on the nopriv variant, or omitting authorization logic within the callback, allows anonymous callers to reach actions reserved for marketplace administrators or vendors.
Attack Vector
An unauthenticated attacker sends HTTP POST requests to the WordPress AJAX endpoint referencing one of the vulnerable actions, such as action=marketking_delete_team_member or action=marketkingrejectuser. The server processes the request, bypasses any role check, and performs the requested operation. Attackers can enumerate marketplace users, reject vendor applications, or overwrite profile configuration data. The attack requires no authentication, no user interaction, and only network access to the target site. See the Wordfence vulnerability record for additional context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-12413
Indicators of Compromise
- Unexpected deletion of vendor team members or rejection of pending vendor applications.
- POST requests to /wp-admin/admin-ajax.php with action parameters matching marketking_delete_team_member, marketkingrejectuser, or marketking_save_profile_settings originating from unauthenticated sessions.
- Modifications to vendor profile settings that do not correlate with legitimate administrator or vendor activity.
Detection Strategies
- Review web server access logs for AJAX requests referencing MarketKing actions without an associated authenticated session cookie.
- Correlate WordPress audit logs with marketplace state changes to identify unauthorized vendor approvals or deletions.
- Alert on bursts of admin-ajax.php traffic targeting MarketKing actions from a single source address.
Monitoring Recommendations
- Enable a WordPress audit logging plugin to record user deletions, role changes, and settings updates.
- Monitor the installed MarketKing plugin version and flag any site still running 2.0.00 or earlier.
- Forward web and application logs to a centralized analytics platform to detect anomalous AJAX activity across managed WordPress estates.
How to Mitigate CVE-2024-12413
Immediate Actions Required
- Update the MarketKing plugin to the version released after changeset 3212032, which adds capability checks to the affected handlers.
- Audit vendor accounts, team members, and plugin settings for unauthorized changes made before patching.
- Restrict access to /wp-admin/admin-ajax.php at the web application firewall when feasible, allowing only expected actions.
Patch Information
The vendor patched the vulnerability in the MarketKing plugin via WordPress plugin changeset 3212032. The patch modifies includes/class-marketking-core.php to add authorization checks to functions such as marketking_delete_team_member, marketkingrejectuser, and marketking_save_profile_settings. Administrators should install the latest release from the WordPress plugin repository.
Workarounds
- Deploy a web application firewall rule that blocks unauthenticated POST requests to admin-ajax.php containing MarketKing action names.
- Temporarily deactivate the MarketKing plugin on affected sites until the patched version is installed.
- Enforce IP allow-listing on WordPress administrative endpoints where the marketplace is used only by internal operators.
# Example WAF rule (ModSecurity) blocking vulnerable MarketKing AJAX actions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
"chain,phase:2,deny,status:403,id:1012413,msg:'Block MarketKing CVE-2024-12413 actions'"
SecRule ARGS:action "@rx ^(marketking_delete_team_member|marketkingrejectuser|marketking_save_profile_settings)$"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
