Executive brief
MarketKing is a multivendor marketplace plugin for WooCommerce that manages vendor stores, products, and commissions on WordPress sites. The plugin fails to properly verify user permissions in a vendor management AJAX function, allowing any logged-in user—even those with minimal subscriber-level access—to retrieve sensitive information about all registered vendors including their internal user IDs, usernames, and email addresses. This information exposure could enable phishing attacks, account targeting, or further exploitation against vendors on the platform.
Technical details
The marketking_admin_vendors_ajax AJAX action lacks proper capability checks, permitting authenticated attackers to bypass role-based access controls and request vendor directory data. Exploitation requires valid WordPress authentication (subscriber role or higher) and a crafted AJAX request, exposing personally identifiable information including user IDs, usernames, and email addresses of all vendors. The vulnerability was patched in version 2.1.72 and later with proper authorization validation.
Affected products
- WebWizards MarketKing before 2.1.72
Timeline
- 2026-09-22: disclosed