# CVE-2026-93343: MarketKing plugin for WordPress missing authorization in vendor AJAX action

Source: https://junglewise.ai/threats/cve-2026-93343-marketking-plugin-for-wordpress-before-2-1-72-contains-a-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93343 · Severity: medium · CVSS 6.5 · Published 2026-09-22

MarketKing is a multivendor marketplace plugin for WooCommerce that manages vendor stores, products, and commissions on WordPress sites. The plugin fails to properly verify user permissions in a vendor management AJAX function, allowing any logged-in user—even those with minimal subscriber-level access—to retrieve sensitive information about all registered vendors including their internal user IDs, usernames, and email addresses. This information exposure could enable phishing attacks, account targeting, or further exploitation against vendors on the platform.

Technologies: [WebWizards MarketKing](https://junglewise.ai/threats/technologies/marketking). Vendors: [WebWizards](https://junglewise.ai/threats/vendors/webwizards).

## Quick answers

**Is CVE-2026-93343 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93343 being exploited in the wild.

**How severe is CVE-2026-93343?** Medium severity, with a CVSS score of 6.5, published 22 September 2026.

**Which products and versions are affected?** WebWizards MarketKing before 2.1.72.

**Is there a fix for CVE-2026-93343?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93343 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93343?** Check whether you run WebWizards MarketKing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The marketking_admin_vendors_ajax AJAX action lacks proper capability checks, permitting authenticated attackers to bypass role-based access controls and request vendor directory data. Exploitation requires valid WordPress authentication (subscriber role or higher) and a crafted AJAX request, exposing personally identifiable information including user IDs, usernames, and email addresses of all vendors. The vulnerability was patched in version 2.1.72 and later with proper authorization validation.

## Affected products

- WebWizards MarketKing before 2.1.72

## Timeline

- 2026-09-22: disclosed

## References

- [https://marketkingplugin.com/changelog/](https://marketkingplugin.com/changelog/)
- [https://wordpress.org/plugins/marketking-multivendor-marketplace-for-woocommerce/](https://wordpress.org/plugins/marketking-multivendor-marketplace-for-woocommerce/)

## Related threats

- [MarketKing plugin for WordPress missing authorization in AJAX action](https://junglewise.ai/threats/cve-2026-93344-marketking-plugin-for-wordpress-before-2-1-72-contains-a-missing)
- [MarketKing plugin for WordPress missing authorization in AJAX action](https://junglewise.ai/threats/cve-2026-93342-marketking-plugin-for-wordpress-before-2-1-72-contains-a-missing)
- [MarketKing plugin for WordPress missing authorization in refund AJAX](https://junglewise.ai/threats/cve-2026-93341-marketking-plugin-for-wordpress-before-2-1-72-contains-a-missing)
- [WebWizards MarketKing broken access control](https://junglewise.ai/threats/cve-2026-27399-webwizards-marketking-broken-access-control)