CVE-2026-94080 Overview
CVE-2026-94080 is a broken access control vulnerability affecting the MarketKing Multivendor Marketplace plugin for WooCommerce on WordPress. The flaw exists in versions up to and including 2.1.70. Unauthenticated attackers can reach plugin functionality that should require authorization checks. The weakness maps to CWE-862: Missing Authorization and is exploitable remotely over the network without user interaction.
Critical Impact
Remote, unauthenticated attackers can invoke protected plugin functionality on WordPress sites running MarketKing <= 2.1.70, leading to limited integrity impact on marketplace data.
Affected Products
- MarketKing Multivendor Marketplace for WooCommerce plugin for WordPress
- All plugin versions up to and including 2.1.70
- WordPress sites operating MarketKing as a WooCommerce multivendor extension
Discovery Timeline
- 2026-09-23 - CVE-2026-94080 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-94080
Vulnerability Analysis
The vulnerability is a Broken Access Control weakness in the MarketKing plugin. The plugin exposes actions that fail to verify the caller's authorization state before executing. As a result, requests originating from unauthenticated users can trigger functionality intended for privileged marketplace roles. The impact is limited to integrity of marketplace data, without direct confidentiality or availability effects according to the published CVSS vector.
Root Cause
The root cause is a missing authorization check, categorized under CWE-862. Affected plugin endpoints do not validate whether the requester holds the required WordPress capability or vendor role before performing state-changing operations. This omission allows unauthenticated actors to reach code paths that should be restricted.
Attack Vector
Exploitation occurs over the network against a WordPress site running a vulnerable MarketKing release. An attacker crafts an HTTP request to the vulnerable plugin endpoint without authenticating and without user interaction. Because the plugin does not enforce a capability check, the request executes with the effect of a legitimate call. Refer to the Patchstack advisory for endpoint-specific technical detail.
No verified proof-of-concept code has been published. The vulnerability mechanism is described here in prose; see the Patchstack advisory for endpoint identifiers and request parameters.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-94080
Indicators of Compromise
- Unauthenticated HTTP POST or GET requests to MarketKing plugin endpoints under /wp-admin/admin-ajax.php or plugin-specific REST routes.
- Unexpected modifications to vendor records, product listings, or marketplace configuration without a corresponding administrator or vendor login event.
- Requests to plugin actions arriving without a valid wp_nonce value or without an authenticated session cookie.
Detection Strategies
- Inspect web server access logs for anonymous requests targeting MarketKing action names or AJAX handlers.
- Correlate WordPress audit logs against authentication events to identify state changes performed without a preceding login.
- Deploy WordPress security plugins or web application firewall rules that flag missing-authorization patterns against WooCommerce vendor endpoints.
Monitoring Recommendations
- Enable verbose logging on the WordPress site and forward events to a centralized log platform for correlation.
- Alert on spikes in requests to MarketKing endpoints from a single source IP or user agent.
- Track plugin version inventory across WordPress estates to identify hosts still running MarketKing <= 2.1.70.
How to Mitigate CVE-2026-94080
Immediate Actions Required
- Identify all WordPress sites running the MarketKing Multivendor Marketplace plugin and confirm the installed version.
- Update MarketKing to a release later than 2.1.70 once the vendor publishes a fixed version.
- Restrict network access to WordPress administrative and AJAX endpoints where feasible until the patch is applied.
Patch Information
Refer to the Patchstack advisory for MarketKing for the fixed version and vendor guidance. Apply the vendor-supplied update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Deploy a virtual patch or WAF rule that blocks unauthenticated requests to MarketKing plugin endpoints.
- Temporarily disable the MarketKing plugin on sites that cannot upgrade immediately.
- Enforce IP allow-listing on /wp-admin/ and plugin REST routes to reduce exposure to unauthenticated actors.
# Update MarketKing to the latest patched release using WP-CLI
wp plugin update marketking-multivendor-marketplace-for-woocommerce
# Verify the installed version is greater than 2.1.70
wp plugin get marketking-multivendor-marketplace-for-woocommerce --field=version
# Temporary mitigation: deactivate the plugin until patched
wp plugin deactivate marketking-multivendor-marketplace-for-woocommerce
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
