Security Alert Summary
The MarketKing plugin for WordPress contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that can allow authenticated users with subscriber-level access or higher to duplicate any vendor’s product by supplying an arbitrary product ID. An attacker can bypass ownership verification to copy listings and private product metadata and assign the duplicated copy to their own vendor account without the original vendor’s knowledge or consent.
CVE Details
- CVE ID: CVE-2026-93342
- Affected component: MarketKing plugin for WordPress (vendor: WebWizards)
- Affected versions: Versions before 2.1.72 (versions less than 2.1.72)
- Published: September 22, 2026 at 2:17:18 PM UTC
- Last modified: September 22, 2026 at 2:17:18 PM UTC
- CVSS v3.1: Base score 5.4 (MEDIUM);
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Authentication / Privileges / User interaction: Requires an authenticated user with low privileges (PR:L). User interaction is not required (UI:N). The disclosure notes the ability to perform this action with subscriber-level access or higher.
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability is a missing authorization check in the AJAX action named marketking_duplicate_product. The action accepts a product identifier and performs a duplication operation without verifying that the authenticated user owns or is authorized to duplicate the specified product. By supplying an arbitrary product ID, an authenticated user with subscriber-level access or higher can create a duplicate of another vendor’s product.
The duplicated copy may include private product metadata that is copied from the original item. The attacker can cause the duplicated product to be assigned to their own vendor account, effectively copying listings and associated metadata without the original vendor’s knowledge or consent. The root cause is an absent or insufficient ownership/authorization verification in the duplicate-product workflow handling the AJAX request.
How This Could Impact Your Website
Consider a site with multiple user roles: a site owner or administrator, internal staff who manage product listings, and external contractors or contributors who have subscriber-level or vendor accounts. An authenticated contributor with minimal privileges could exploit this issue to duplicate other vendors’ products and import any private metadata attached to those listings into their own vendor account.
- Copied private product metadata may expose information that was intended to remain internal. In some setups, metadata can include contact details or notes that increase the risk of information disclosure.
- Duplicated listings assigned to another vendor account can cause confusion, inventory discrepancies, and reputational issues between vendors on a marketplace site.
- Access to private metadata and listings may increase the likelihood of targeted phishing or social engineering against staff or vendors if contact details are exposed.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and vendor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and audit plugin sources before installation.
- Monitor site activity and logs for unusual behavior related to product creation, duplication, or changes to vendor assignments.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
