Description

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers can submit crafted AJAX requests targeting any order ID to create fraudulent refund requests against orders they did not place, enabling marketplace disruption and unauthorized interference with other users' orders.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-22T14:17:18.070Z",
  "pubdate": "2026-09-22T14:17:18.070Z",
  "executiveSummary": "The MarketKing plugin for WordPress, in versions prior to 2.1.72, is susceptible to a missing authorization vulnerability within its AJAX processing logic. This flaw stems from the failure of the marketking_send_refund function to verify that the user initiating the request holds the necessary permissions or possesses ownership of the targeted order.\nThe vulnerability allows any authenticated user, including those with minimal subscriber-level privileges, to trigger refund request mechanisms for arbitrary order IDs. By manipulating the parameters in the AJAX request, an attacker can force the creation of fraudulent refund requests for orders they did not place. This oversight poses a significant threat to marketplace integrity, potentially resulting in unauthorized interference with financial transactions, data manipulation, and operational disruption.\nExploitation requires active authentication on the target WordPress instance, but no specialized administrative capabilities are necessary to invoke the vulnerable functionality. The risk is high for multi-vendor marketplaces using the plugin, as it facilitates unauthorized interaction with other users' order data, necessitating immediate attention and remediation.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authorization checks within the marketking_send_refund AJAX action handler. In WordPress development, AJAX handlers intended for specific user actions must explicitly validate the current user's session and verify ownership or authorization permissions for the data being accessed or modified. The MarketKing plugin failed to enforce these security controls, allowing any authenticated session to interact with the backend refund processing logic.\nThe attack flow begins when an attacker sends a crafted POST request to the WordPress admin-ajax.php endpoint. The payload includes the action parameter set to 'marketking_send_refund' and a specific 'order_id' parameter corresponding to the targeted order. Because the function does not validate whether the requesting user is the rightful owner of the order or possesses the necessary 'manage_woocommerce_orders' or equivalent capabilities, the system proceeds to process the refund request.\nThe vulnerability manifests because the server-side code trusts the 'order_id' provided in the request without performing server-side verification of user-order association. Consequently, an attacker can iterate through sequential order IDs or target specific IDs to flood the system with invalid requests. This lack of access control effectively bypasses the expected business logic, which should restrict refund requests exclusively to the individual who performed the purchase or to authorized administrators.\nThe vulnerable component is the server-side implementation of the refund request handler. Impact extends beyond mere nuisance; by flooding a marketplace with fraudulent refund requests, an attacker can create significant administrative overhead, compromise the reliability of the refund workflow, and cause financial or reputational damage to vendors. Since the request is performed over a standard HTTP/HTTPS connection using legitimate WordPress AJAX protocols, the attack is subtle and difficult to distinguish from valid traffic without specific behavioral monitoring or logging of non-authorized access to the marketking_send_refund function."
}