# CVE-2026-27399: WebWizards MarketKing broken access control

Source: https://junglewise.ai/threats/cve-2026-27399-webwizards-marketking-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-27399 · Severity: medium · CVSS 5.3 · Published 2026-07-23

MarketKing is a multi-vendor marketplace plugin for WordPress that allows site owners to run stores with multiple independent sellers. A security flaw in versions 2.1.40 and earlier allows unauthenticated users to perform actions they should not have permission for due to missing authorization checks. While the impact is rated as medium, it could allow unauthorized changes to certain site settings or data without requiring a login.

Technologies: [WebWizards MarketKing](https://junglewise.ai/threats/technologies/marketking). Vendors: [WebWizards](https://junglewise.ai/threats/vendors/webwizards).

## Quick answers

**Is CVE-2026-27399 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27399 being exploited in the wild.

**How severe is CVE-2026-27399?** Medium severity, with a CVSS score of 5.3, published 23 July 2026.

**Which products and versions are affected?** WebWizards MarketKing <= 2.1.40.

**Is there a fix for CVE-2026-27399?** A patch was published on 2026-07-23: NVD publication and patch availability confirmed in version 2.1.50 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27399 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27399?** Check whether you run WebWizards MarketKing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MarketKing plugin for WordPress (versions <= 2.1.40) is vulnerable to broken access control due to missing authorization (CWE-862) on certain functions. An unauthenticated remote attacker can exploit this vulnerability by sending crafted requests to the affected site, potentially allowing them to execute actions that should be restricted to higher-privileged users. The vulnerability stems from a lack of proper authentication or nonce token checks. The issue is resolved in version 2.1.50.

## Affected products

- WebWizards / Kings Plugins MarketKing <= 2.1.40

## Timeline

- 2025-11-10: disclosed: Reported by Legion Hunter to Patchstack
- 2026-07-21: advisory: Patchstack advisory published
- 2026-07-23: patched: NVD publication and patch availability confirmed in version 2.1.50

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/marketking-multivendor-marketplace-for-woocommerce/vulnerability/wordpress-marketking-plugin-2-1-40-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/marketking-multivendor-marketplace-for-woocommerce/vulnerability/wordpress-marketking-plugin-2-1-40-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [MarketKing plugin for WordPress missing authorization in AJAX action](https://junglewise.ai/threats/cve-2026-93344-marketking-plugin-for-wordpress-before-2-1-72-contains-a-missing)
- [MarketKing plugin for WordPress missing authorization in vendor AJAX action](https://junglewise.ai/threats/cve-2026-93343-marketking-plugin-for-wordpress-before-2-1-72-contains-a-missing)
- [MarketKing plugin for WordPress missing authorization in AJAX action](https://junglewise.ai/threats/cve-2026-93342-marketking-plugin-for-wordpress-before-2-1-72-contains-a-missing)
- [MarketKing plugin for WordPress missing authorization in refund AJAX](https://junglewise.ai/threats/cve-2026-93341-marketking-plugin-for-wordpress-before-2-1-72-contains-a-missing)