Missing Authorization Vulnerability in MarketKing Plugin for WordPress

CVE-2026-93342

What is CVE-2026-93342?

The MarketKing plugin for WordPress prior to version 2.1.72 is susceptible to a missing authorization vulnerability. This flaw exists within the marketking_duplicate_product AJAX action, enabling authenticated attackers with subscriber-level access or higher to duplicate any vendor's products by merely providing an arbitrary product ID. Consequently, attackers can circumvent ownership verification processes, allowing them to replicate any vendor's product listings—along with private product metadata—and assign these duplicates to their own vendor accounts without the acknowledgment or consent of the original vendor.

References