CVE-2026-93343 Overview
CVE-2026-93343 is a missing authorization vulnerability [CWE-862] in the MarketKing multivendor marketplace plugin for WordPress. Versions prior to 2.1.72 fail to enforce capability checks on the marketking_admin_vendors_ajax AJAX action. Any authenticated user with subscriber-level access or higher can invoke the action and retrieve the complete vendor directory. The response exposes internal user IDs, usernames, and email addresses of every registered vendor on the site.
Critical Impact
Authenticated attackers with minimal privileges can enumerate personally identifiable information (PII) for all vendors on the marketplace, enabling targeted phishing, credential stuffing, and account takeover campaigns.
Affected Products
- MarketKing Multivendor Marketplace for WooCommerce plugin for WordPress
- All plugin versions prior to 2.1.72
- WordPress sites running MarketKing with open user registration enabled
Discovery Timeline
- 2026-09-22 - CVE-2026-93343 published to the National Vulnerability Database (NVD)
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93343
Vulnerability Analysis
The MarketKing plugin registers the marketking_admin_vendors_ajax action through the WordPress AJAX framework. The handler is intended for administrative vendor management operations. However, the handler does not verify the calling user's capabilities before returning vendor data.
WordPress exposes AJAX actions registered with the wp_ajax_ prefix to any authenticated user. Without a current_user_can() check or nonce validation tied to an administrative capability, the endpoint becomes reachable by every logged-in role, including the default subscriber role. Sites allowing open registration are directly exposed to unauthenticated actors who can create an account and reach the endpoint.
The returned payload includes internal user IDs, WordPress usernames, and vendor email addresses. This information supports downstream attacks such as targeted phishing, credential stuffing against the WordPress login page, and vendor impersonation on the marketplace.
Root Cause
The root cause is a missing authorization check in the AJAX action handler. The code executes the vendor lookup logic without gating access behind a capability such as manage_woocommerce or manage_options. This class of flaw is tracked as CWE-862: Missing Authorization.
Attack Vector
The attack is network-reachable and requires only low-privilege authentication. An attacker registers a subscriber account, obtains a valid WordPress session cookie, and issues a POST request to /wp-admin/admin-ajax.php with the action parameter set to marketking_admin_vendors_ajax. The server returns the complete vendor directory in the response body.
No user interaction is required from an administrator, and exploitation leaves standard access-log entries indistinguishable from routine AJAX traffic. Refer to the VulnCheck Advisory on MarketKing for additional technical detail.
Detection Methods for CVE-2026-93343
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing the parameter action=marketking_admin_vendors_ajax from non-administrative user sessions.
- Unusually large AJAX response bodies from admin-ajax.php correlated with subscriber-role session cookies.
- Newly registered subscriber accounts that issue AJAX requests within minutes of account creation.
Detection Strategies
- Parse WordPress access logs for the marketking_admin_vendors_ajax action string and correlate the source user ID with assigned roles.
- Deploy a web application firewall (WAF) rule that blocks or alerts on the action name when the requesting session lacks an administrator or shop-manager role.
- Monitor MarketKing plugin versions across managed WordPress fleets and flag any installation below 2.1.72.
Monitoring Recommendations
- Enable WordPress audit logging plugins to capture AJAX invocations with user, role, and IP context.
- Forward WordPress and web server telemetry to a centralized data lake for correlation with authentication events and new-account creation.
- Track outbound email volume to vendor addresses following any suspected enumeration event to identify follow-on phishing campaigns.
How to Mitigate CVE-2026-93343
Immediate Actions Required
- Update the MarketKing plugin to version 2.1.72 or later on every affected WordPress installation.
- Audit registered user accounts and delete unrecognized subscriber-level accounts created before the patch was applied.
- Force a password reset for vendor accounts whose email addresses may have been exposed.
Patch Information
The vendor addressed the vulnerability in MarketKing version 2.1.72. Release details are documented in the MarketKing Plugin Changelog and the plugin listing on WordPress.org. Administrators should apply the update through the WordPress Plugins dashboard or via WP-CLI.
Workarounds
- Disable open user registration under Settings → General until the plugin can be updated.
- Deploy a WAF rule that blocks POST requests to admin-ajax.php where action=marketking_admin_vendors_ajax originates from non-administrative sessions.
- Temporarily deactivate the MarketKing plugin if patching cannot be performed within the maintenance window.
# Update MarketKing using WP-CLI
wp plugin update marketking-multivendor-marketplace-for-woocommerce --version=2.1.72
# Verify the installed version
wp plugin get marketking-multivendor-marketplace-for-woocommerce --field=version
# Disable open registration as a temporary control
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
