CVE-2026-93341: MarketKing WordPress Auth Bypass Flaw

CVE-2026-93341 Overview

CVE-2026-93341 is a missing authorization vulnerability in the MarketKing multivendor marketplace plugin for WordPress. Versions before 2.1.72 fail to validate order ownership in the marketking_send_refund AJAX action. Authenticated users with subscriber-level access or higher can submit refund requests against any order by supplying an arbitrary order ID. The flaw is tracked under CWE-862: Missing Authorization and enables marketplace disruption through fraudulent refund submissions against orders placed by other users.

Critical Impact
Any authenticated user, including subscribers, can create fraudulent refund requests against arbitrary WooCommerce orders, disrupting marketplace operations and interfering with legitimate transactions.

Affected Products

MarketKing Multivendor Marketplace for WooCommerce plugin for WordPress
All versions prior to 2.1.72
WordPress sites using MarketKing with open user registration

Discovery Timeline

2026-09-22 - CVE-2026-93341 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93341

Vulnerability Analysis

The vulnerability resides in the marketking_send_refund AJAX handler exposed by the MarketKing plugin. The handler processes refund submissions but does not verify that the requesting user owns the referenced order. An attacker with any authenticated role, including the low-privilege subscriber role, can invoke the endpoint with an arbitrary order ID. The plugin accepts the request and creates a refund entry against the targeted order.

This breaks the trust boundary between authenticated marketplace participants and order owners. Vendors and customers cannot rely on refund state integrity. The vulnerability is exploitable remotely over the network without user interaction.

Root Cause

The root cause is a missing authorization check [CWE-862] in the refund AJAX action. The handler validates that the request comes from an authenticated session but does not confirm that the current user is the buyer, vendor, or administrator associated with the supplied order ID. Nonce or capability verification alone is insufficient because both are satisfied by any logged-in user acting on their own session.

Attack Vector

Exploitation requires an account on the target WordPress site. On marketplaces with open registration, this bar is trivial. The attacker authenticates, obtains a valid session and nonce, then submits a crafted admin-ajax.php POST request to the marketking_send_refund action with an order ID they do not own. The server processes the request and records a refund submission against that order. Repeated requests can flood vendors with fraudulent refund workflows.

See the VulnCheck Advisory: Missing Authorization for additional technical context.

Detection Methods for CVE-2026-93341

Indicators of Compromise

Unexpected refund requests appearing against orders whose buyers did not initiate them
POST requests to /wp-admin/admin-ajax.php with the parameter action=marketking_send_refund originating from low-privilege user sessions
Vendor complaints about unrecognized refund tickets tied to their storefront
Spikes in refund submissions from subscriber accounts with no purchase history

Detection Strategies

Review web server and WordPress access logs for admin-ajax.php requests referencing the marketking_send_refund action and correlate the requesting user ID with the order's owning customer
Query the WooCommerce and MarketKing refund tables for entries where the submitter user ID does not match the order's _customer_user metadata
Alert on authenticated users invoking marketking_send_refund against multiple distinct order IDs within a short window

Monitoring Recommendations

Ingest WordPress and WooCommerce audit logs into a centralized SIEM or data lake and retain them long enough to reconstruct refund submission history
Monitor newly registered subscriber accounts that begin issuing AJAX requests to marketplace endpoints shortly after registration
Track baseline refund request volume per vendor and alert on statistical anomalies

How to Mitigate CVE-2026-93341

Immediate Actions Required

Update the MarketKing Multivendor Marketplace plugin to version 2.1.72 or later on all WordPress sites
Audit existing refund requests created before the patch date and reconcile any that do not match the order's legitimate customer
Review WordPress user registration settings and disable open subscriber registration if it is not required

Patch Information

The vendor addressed the missing authorization check in MarketKing 2.1.72. Details are published in the MarketKing Plugin Changelog. Administrators can install the fixed release from the WordPress MarketKing Plugin Overview page or through the WordPress admin plugin updater.

Workarounds

Restrict access to admin-ajax.php for the marketking_send_refund action via a web application firewall rule until the patch is applied
Temporarily disable the MarketKing plugin on sites that cannot immediately update, if marketplace functionality is not business-critical
Remove or downgrade unnecessary subscriber-level accounts and require email verification for new registrations

bash

# Example: block unauthenticated refund AJAX abuse at the WAF layer
# ModSecurity rule snippet
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,id:1029334,phase:2,deny,status:403,log,msg:'Block MarketKing refund AJAX pending patch'"
  SecRule ARGS:action "@streq marketking_send_refund"