Description

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor user ID. Attackers can bypass authorization controls by submitting a target vendor ID in the request to access payout pages, financial reports, and vendor dashboard content belonging to any vendor in the marketplace.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-22T15:17:21.690Z",
  "pubdate": "2026-09-22T15:17:21.690Z",
  "executiveSummary": "The MarketKing WordPress plugin, in versions prior to 2.1.72, suffers from a critical missing authorization vulnerability within the 'marketking_get_page_content' AJAX action.\nThis flaw allows authenticated users, regardless of their low-level subscriber permissions, to bypass intended access control mechanisms by manipulating request parameters.\nBy supplying an arbitrary vendor ID, an attacker can gain unauthorized access to restricted vendor-specific administrative pages.\nThe impact includes the exposure of sensitive marketplace data, including payout information, financial reports, and private vendor dashboard content.\nThis vulnerability poses a significant risk to marketplace privacy and integrity, as attackers can perform unauthorized reconnaissance or data exfiltration on any vendor account within the platform.\nThe exploitation does not require administrative privileges, as the lack of robust server-side authorization checks for the 'marketking_get_page_content' action allows any authenticated account to perform the unauthorized request.",
  "technicalDetails": "The vulnerability resides in the 'marketking_get_page_content' AJAX handler within the MarketKing plugin. The core issue is an improper implementation of authorization checks that fail to validate whether the current authenticated user owns or is authorized to view the requested resource.\nDuring the AJAX request processing, the application relies on user-supplied input to identify the target vendor dashboard content. Specifically, the function processes an identifier (vendor ID) provided in the request parameters without verifying if the requesting user holds the required permissions or has an ownership relationship with that specific vendor account.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the WordPress site with at least a subscriber-level account. 2) The attacker initiates an AJAX request to the 'marketking_get_page_content' action, appending the target vendor ID as a parameter. 3) Because the function lacks an explicit capability check or nonce verification that binds the session to the requested ID, the server proceeds to render the requested vendor-side content. 4) The application returns the restricted HTML/data of the target vendor's dashboard, payout page, or financial report directly to the attacker.\nThis represents an Insecure Direct Object Reference (IDOR) pattern manifested as a missing authorization vulnerability. The vulnerable component fails to perform an access control check at the controller level before fetching data from the database. Consequently, the application treats the request as a legitimate query, enabling horizontal privilege escalation.\nThe scope of the impact includes the leakage of sensitive financial data, vendor performance metrics, and proprietary marketplace intelligence. Because the vulnerability exists at the AJAX action level, the attack is executed through the WordPress standard 'admin-ajax.php' interface, making it reachable by any user capable of authenticating. No special elevated privileges are required for the exploit, as the plugin fails to enforce the 'marketking_vendor' or 'administrator' roles before executing the sensitive data retrieval function. Affected versions are all instances of the plugin prior to 2.1.72."
}