CVE-2026-93344: MarketKing WordPress Plugin Auth Bypass

CVE-2026-93344 Overview

CVE-2026-93344 is a missing authorization vulnerability in the MarketKing multivendor marketplace plugin for WordPress. Versions before 2.1.72 expose the marketking_get_page_content AJAX action without adequate access checks. Authenticated attackers with subscriber-level access or higher can supply an arbitrary vendor user ID and retrieve administrator panel pages belonging to any vendor. Exposed content includes payout pages, financial reports, and vendor dashboard views. The flaw is categorized as [CWE-862] Missing Authorization.

Critical Impact

Any authenticated user, including low-privilege subscribers, can read sensitive vendor administration content such as payout records and financial reports across the marketplace.

Affected Products

• MarketKing plugin for WordPress versions prior to 2.1.72
• WordPress marketplaces built on WooCommerce that install MarketKing
• Multivendor storefronts exposing the marketking_get_page_content AJAX endpoint

Discovery Timeline

• 2026-09-22 - CVE-2026-93344 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93344

Vulnerability Analysis

The MarketKing plugin exposes an AJAX action named marketking_get_page_content that returns rendered vendor administrator panel pages. The handler accepts a vendor user ID from the request and returns page content for that vendor without confirming the requester owns or has rights to that vendor account. As a result, an attacker who holds any authenticated WordPress role, including the default subscriber role, can request pages belonging to arbitrary vendors. Returned content includes vendor payout screens, sales and financial reports, and dashboard views used by shop operators. The impact is limited to information disclosure. The advisory does not report modification or denial of service through this endpoint.

Root Cause

The root cause is a missing authorization check in the marketking_get_page_content AJAX handler. The plugin authenticates the request but does not verify that the caller is the vendor identified by the supplied user ID, nor that the caller holds a role authorized to view another vendor's data. Trust is placed on the client-supplied vendor ID.

Attack Vector

Exploitation requires only a valid WordPress account on the target site. An attacker registers or uses an existing subscriber account, authenticates, and submits a POST request to admin-ajax.php invoking the marketking_get_page_content action with a target vendor's user ID. The server returns the rendered vendor panel page. See the VulnCheck Advisory on MarketKing for technical details.

No verified proof-of-concept code is published for this issue. Refer to the Market King Plugin Changelog and the WordPress MarketKing Plugin Info for version and fix references.

Detection Methods for CVE-2026-93344

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php containing the parameter action=marketking_get_page_content originating from subscriber-level accounts.
• Repeated requests to marketking_get_page_content iterating through sequential vendor user ID values, indicating enumeration.
• Unexpected access to vendor payout, report, or dashboard pages by accounts that are not registered vendors.

Detection Strategies

• Inspect WordPress access logs for admin-ajax.php calls invoking marketking_get_page_content and correlate the requesting user role with the vendor ID parameter.
• Alert when a single authenticated session queries multiple distinct vendor IDs through the vulnerable AJAX action within a short window.
• Review WooCommerce and MarketKing audit logs for vendor dashboard views attributed to non-vendor accounts.

Monitoring Recommendations

• Enable a WordPress activity logging plugin to record AJAX action invocations along with the authenticated user and parameters.
• Forward web server and WordPress logs to a centralized log platform and build alerts for the marketking_get_page_content action.
• Monitor account creation trends for spikes in subscriber registrations that precede AJAX enumeration activity.

How to Mitigate CVE-2026-93344

Immediate Actions Required

• Upgrade the MarketKing plugin to version 2.1.72 or later on all affected WordPress installations.
• Audit recent access logs for use of the marketking_get_page_content AJAX action by non-vendor accounts and identify potentially exposed vendor data.
• Review vendor payout and financial report access history and notify affected vendors if unauthorized disclosure is suspected.

Patch Information

The vendor released MarketKing 2.1.72 to address the missing authorization check in the marketking_get_page_content handler. Refer to the Market King Plugin Changelog for release notes and to the WordPress MarketKing Plugin Info page for the current distribution.

Workarounds

• If patching is not immediately possible, restrict new account registrations to reduce the population of subscriber accounts available to attackers.
• Place the WordPress site behind a web application firewall rule that blocks unauthenticated and low-privilege requests to admin-ajax.php carrying action=marketking_get_page_content.
• Temporarily disable the MarketKing plugin on production sites where vendor data confidentiality outweighs marketplace availability.

# Example WAF rule concept: block subscriber-level access to the vulnerable AJAX action
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1009344,msg:'Block MarketKing CVE-2026-93344 AJAX action'"
  SecRule ARGS:action "@streq marketking_get_page_content"