CVE-2026-93342: MarketKing WordPress Plugin Auth Bypass

CVE-2026-93342 Overview

CVE-2026-93342 is a missing authorization vulnerability [CWE-862] in the MarketKing multivendor marketplace plugin for WordPress. The flaw resides in the marketking_duplicate_product AJAX action and affects all versions prior to 2.1.72. Authenticated attackers with subscriber-level access or higher can duplicate any vendor's product by supplying an arbitrary product ID. The plugin fails to verify ownership before performing the duplication, allowing attackers to copy competitor listings and reassign them to their own vendor account. The duplicated payload includes private product metadata that would otherwise remain confidential to the original vendor.

Critical Impact
Authenticated low-privilege users can steal any vendor's product listings, including private metadata, and reassign ownership to their own vendor account without the victim's knowledge.

Affected Products

MarketKing Multivendor Marketplace plugin for WooCommerce
All versions prior to 2.1.72
WordPress sites running MarketKing with subscriber registration enabled

Discovery Timeline

2026-09-22 - CVE-2026-93342 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-93342

Vulnerability Analysis

The MarketKing plugin exposes an AJAX endpoint named marketking_duplicate_product that allows vendors to duplicate their own product listings. The handler accepts a product ID parameter from the client. It then creates a copy of the referenced product and assigns the new record to the requesting user's vendor account.

The endpoint verifies that the caller is authenticated. It does not verify that the caller owns the product being duplicated. Any user with subscriber-level access or higher can submit the request, regardless of vendor status or ownership relationship. This categorizes the flaw as a Missing Authorization weakness and a Broken Access Control issue.

Because WordPress sites frequently allow open user registration, the effective attack surface can extend to any anonymous internet user willing to register a free account. The duplicated record carries private product metadata that the original vendor never intended to expose.

Root Cause

The root cause is the absence of a capability check tying the requesting user to the target product prior to duplication. The handler validates authentication and nonce state but omits an ownership comparison between the current user's vendor ID and the target product's vendor ID. Access decisions rely solely on authentication rather than on authorization for the specific resource being acted upon.

Attack Vector

Exploitation requires network access to the WordPress admin AJAX endpoint and a valid low-privilege account. The attacker enumerates or guesses product IDs belonging to a target vendor. The attacker then issues a POST request to admin-ajax.php invoking the marketking_duplicate_product action with the targeted product ID. The plugin creates a duplicate assigned to the attacker's vendor profile, including private metadata copied from the source product. Full technical details are available in the VulnCheck Advisory on MarketKing.

No verified proof-of-concept code is published. Refer to the vendor and third-party advisories for authoritative technical details.

Detection Methods for CVE-2026-93342

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with the action=marketking_duplicate_product parameter originating from subscriber or customer accounts.
Sudden creation of duplicate product records in the WooCommerce database where the new vendor owner differs from the source product's vendor.
Unexpected vendor account activity from accounts with no prior product publishing history.
Vendor complaints about unauthorized copies of their listings appearing under other vendor storefronts.

Detection Strategies

Review web server access logs for repeated calls to the marketking_duplicate_product AJAX action tied to a single session or IP address.
Query the wp_posts and wp_postmeta tables for products with identical titles, SKUs, or metadata but differing vendor ownership.
Correlate WordPress user registration events with subsequent AJAX invocations against duplication endpoints.

Monitoring Recommendations

Enable WordPress audit logging for AJAX actions issued by non-administrator users.
Alert on any subscriber-role user invoking vendor-scoped AJAX actions.
Monitor for spikes in product creation events attributable to newly registered accounts.

How to Mitigate CVE-2026-93342

Immediate Actions Required

Upgrade the MarketKing plugin to version 2.1.72 or later on all affected WordPress installations.
Audit product records created since the plugin was installed to identify unauthorized duplicates.
Review vendor account registrations for suspicious accounts created prior to the upgrade.
Rotate any private product metadata (supplier data, cost fields, internal SKUs) that may have been exposed.

Patch Information

The vendor addressed CVE-2026-93342 in MarketKing version 2.1.72. The fix adds an ownership verification check within the marketking_duplicate_product AJAX handler. Consult the MarketKing Plugin Changelog and the WordPress Plugin Overview for release details.

Workarounds

Temporarily disable open subscriber registration on the WordPress site until the patch is applied.
Restrict access to admin-ajax.php from untrusted networks via a web application firewall rule blocking the marketking_duplicate_product action for non-vendor roles.
Deactivate the MarketKing plugin on affected sites if immediate patching is not feasible and vendor functionality can be paused.

bash

# Example WP-CLI command to upgrade the MarketKing plugin to the patched release
wp plugin update marketking-multivendor-marketplace-for-woocommerce --version=2.1.72