Description

Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T09:17:11.490Z",
  "pubdate": "2026-09-04T09:17:11.490Z",
  "executiveSummary": "The MarketKing plugin for WordPress is susceptible to a Missing Authorization vulnerability, classified under improper access control. This flaw allows unauthorized users to perform restricted actions that should be gated by appropriate permission checks.\nThe vulnerability affects all versions of the MarketKing plugin from n/a through 2.1.60. By failing to validate the authorization level of the requesting user, the plugin exposes administrative or sensitive functionalities to users who do not possess the required privileges.\nAn unauthenticated or low-privileged attacker can exploit this security gap to interact with backend processes, potentially leading to unauthorized data manipulation or modification of plugin settings. The risk implication is significant as it undermines the integrity of the plugin's security model, allowing actors to bypass established access control policies. Exploitation does not require advanced access levels, meaning a standard registered user or an unauthenticated visitor could potentially invoke privileged functions depending on the specific endpoint implementation.\nOrganizations utilizing MarketKing must treat this vulnerability with high priority, as it permits unauthorized state changes within the application environment. Ensuring that every entry point within the plugin enforces strict user role verification is essential to preventing further exploitation.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient enforcement of authorization checks within the MarketKing plugin's request handling logic. In various functions responsible for plugin operations, the developer failed to implement server-side validation to verify if the current user possesses the necessary capabilities (such as 'manage_options' or 'edit_posts') before executing sensitive code paths.\nThe vulnerability manifests because the plugin processes incoming HTTP requests without verifying the session's authorization scope. Typically, WordPress plugins should utilize `current_user_can()` to validate that the request initiator has the requisite permissions for the target operation. In affected versions 2.1.60 and prior, these calls are either absent or improperly implemented, allowing an attacker to craft arbitrary requests to the vulnerable endpoints.\nThe attack flow follows a predictable pattern: 1) The attacker identifies the exposed plugin endpoints or administrative AJAX/REST API actions. 2) The attacker crafts an HTTP request (GET or POST) targeting these endpoints, bypassing the UI-based security checks. 3) Because the server-side code does not perform a secondary authorization check during the request processing, the backend function executes the action with the privileges of the system or the current session context, regardless of the user's actual role. 4) The application processes the request, resulting in unauthorized modifications, data retrieval, or configuration changes.\nThe vulnerable component involves the internal access control mechanisms of the MarketKing plugin, specifically within its request routing and action processing architecture. Since this flaw does not rely on a specific authentication token, it essentially permits elevation of privilege. An attacker can leverage this to manipulate vendor account data, plugin settings, or perform other restricted operations that the plugin facilitates. The exposure is network-based, meaning any user capable of reaching the WordPress instance can potentially trigger these actions. The post-exploitation impact is severe, as it allows attackers to alter plugin behavior, inject malicious data into the market structure, or perform actions reserved for site administrators or high-level vendors, effectively compromising the integrity of the MarketKing ecosystem on the affected WordPress installation."
}