Description

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification to copy any vendor's product listings, including private product metadata, and assign the duplicated copy to their own vendor account without the victim's knowledge or consent.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-22T14:17:18.230Z",
  "pubdate": "2026-09-22T14:17:18.230Z",
  "executiveSummary": "MarketKing versions prior to 2.1.72 contain a missing authorization vulnerability within the marketking_duplicate_product AJAX action. This security flaw enables authenticated users, specifically those with subscriber-level permissions or higher, to bypass ownership verification mechanisms when duplicating products.\nBy manipulating the request parameters, an attacker can target arbitrary product IDs belonging to other vendors. The application fails to validate whether the requester possesses the appropriate privileges or ownership rights over the resource being duplicated. As a result, the system creates a copy of the specified product, including sensitive metadata, and assigns it to the attacker's own vendor account. This unauthorized operation facilitates intellectual property theft, data exfiltration of private product information, and potential manipulation of vendor inventory. The vulnerability poses a significant risk to multi-vendor marketplace integrity, as it allows unauthorized users to clone product listings without the consent or knowledge of the original vendor. Successful exploitation requires an authenticated session, but requires no administrative or elevated vendor privileges beyond a standard subscriber account.",
  "technicalDetails": "The vulnerability resides within the server-side handling of the 'marketking_duplicate_product' AJAX action. The root cause of this flaw is an inadequate authorization check during the execution of the product duplication logic. Specifically, the function responsible for processing this action fails to verify the identity of the user requesting the operation against the ownership metadata of the target product ID.\nWhen an AJAX request is dispatched to the 'marketking_duplicate_product' endpoint, the application expects an identifier representing the product to be duplicated. Due to the lack of server-side capability or ownership validation, the backend process trusts the provided product ID implicitly. An attacker can intercept or construct a POST request containing a chosen 'product_id'.\nThe attack flow proceeds as follows: First, the attacker identifies a target product ID of a vendor they wish to clone. Second, the attacker sends a crafted request to the 'marketking_duplicate_product' action with the target product ID passed as a parameter. Third, the plugin backend processes this request, fetches the metadata associated with the target ID, and creates a duplicate entry in the database. Finally, the system associates the newly created duplicate with the attacker's own user account context.\nBecause the function does not verify if the current user owns the source product, it allows the unauthorized cloning of proprietary data, including private custom fields and product-specific attributes that may be intended only for the original vendor. The vulnerability effectively turns a legitimate administrative function into an information disclosure and unauthorized data creation mechanism. The impact is exacerbated in multi-vendor environments where vendors compete on product inventory and unique offerings. By exploiting this, an attacker can populate their store with the catalog of other vendors without the necessary authorization or effort, leading to business logic abuse. The flaw is present in all versions of the MarketKing plugin prior to 2.1.72. The exposure is limited to authenticated users; however, given that subscriber-level access is sufficient, the barrier to entry for exploitation is low, especially in marketplaces that allow open registration."
}