Missing Authorization in MarketKing Plugin Allows Data Exposure

CVE-2026-93343

What is CVE-2026-93343?

The MarketKing plugin for WordPress prior to version 2.1.72 contains a flaw that permits authenticated users with subscriber-level access or above to send crafted AJAX requests. This vulnerability arises from a lack of necessary capability checks in the marketking_admin_vendors_ajax action, enabling attackers to gain access to the complete vendor directory. As a result, sensitive information, including user IDs, usernames, and email addresses of all registered vendors, can be retrieved by any logged-in user, compromising the privacy of personally identifiable information.

References