Description

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request. Attackers can exploit the absence of capability checks in the vendor management action to retrieve internal user IDs, usernames, and email addresses of all registered vendors, exposing personally identifiable information to any logged-in user regardless of role.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-22T14:17:18.380Z",
  "pubdate": "2026-09-22T14:17:18.380Z",
  "executiveSummary": "MarketKing for WordPress, in versions prior to 2.1.72, is affected by an improper authorization vulnerability within its AJAX management interface. This security flaw stems from the omission of necessary capability checks in the 'marketking_admin_vendors_ajax' action, which governs vendor-related data retrieval. The vulnerability allows any authenticated user, including those with minimal 'subscriber' privileges, to bypass intended access controls and extract sensitive vendor data.\nThe primary risk associated with this vulnerability is the unauthorized exposure of Personally Identifiable Information (PII) belonging to all registered vendors on the platform. By crafting specific AJAX requests, an attacker can exfiltrate internal user IDs, usernames, and email addresses. This unauthorized data disclosure poses significant privacy risks and could serve as a precursor to further malicious activities, such as targeted phishing, social engineering, or privilege escalation attempts against the vendor user base. Given that the exploitation requires only a standard subscriber account and is accessible via the front-end AJAX endpoint, the overall risk is considered elevated for platforms utilizing MarketKing for multi-vendor functionality.",
  "technicalDetails": "The vulnerability resides in the 'marketking_admin_vendors_ajax' AJAX handler, a backend function designed to process administrative requests related to vendor management. The root cause of the security flaw is a missing authorization check; specifically, the function fails to validate the user's role or capabilities (e.g., 'manage_options' or vendor management permissions) before executing its logic and returning the requested data to the client.\nExploitation is straightforward and does not require elevated privileges or special administrative access. Any attacker authenticated as a subscriber can interact with the WordPress 'admin-ajax.php' endpoint. By submitting an HTTP POST request that targets the 'marketking_admin_vendors_ajax' action, the attacker can trigger the underlying server-side code without triggering a security exception. The application then processes the request and serializes the complete directory of vendors, including sensitive PII, into the response body.\nThe attack flow proceeds as follows: First, the attacker establishes a valid session on the target WordPress site, typically via a subscriber-level account. Second, the attacker crafts a request to the WordPress AJAX handler, specifying the vulnerable action parameter. Because the plugin does not enforce a 'current_user_can()' check within the 'marketking_admin_vendors_ajax' hook, the server assumes the requester has the requisite administrative permissions. Finally, the application queries the database and returns a dataset containing the full list of vendors, user IDs, usernames, and email addresses, which the attacker then parses to facilitate PII harvesting.\nThe vulnerability is present in all versions of the MarketKing plugin prior to 2.1.72. The exposure is limited to authenticated users; however, because many WordPress sites allow self-registration, the barrier to entry is extremely low. The impact of successful exploitation is total vendor enumeration, which compromises the privacy of the vendor population and provides an attacker with a comprehensive map of the system's administrative users and contributors. This information is highly valuable for reconnaissance in more complex multi-stage attacks."
}