Security Alert Summary
The MarketKing plugin for WordPress before version 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action. Authenticated users with subscriber-level access or higher can submit crafted AJAX requests that create refund requests for arbitrary order IDs, allowing fraudulent refund requests and unauthorized interference with other users’ orders.
CVE Details
- CVE ID: CVE-2026-93341
- Affected component: MarketKing plugin for WordPress (marketking_send_refund AJAX action)
- Affected versions: Versions before 2.1.72
- Published: September 22, 2026 at 2:17:18 PM UTC
- Last modified: September 22, 2026 at 3:17:21 PM UTC
- CVSS v3.1: Base score 4.3 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / Privileges / User interaction: Attackers must be authenticated (subscriber-level access or higher). Privileges required: Low. User interaction: None.
- Primary impact: Confidentiality: None. Integrity: Low. Availability: None.
- Weakness (CWE): CWE-862 (Missing Authorization)
Technical Details
This vulnerability is a missing authorization check in the marketking_send_refund AJAX action. The plugin accepts an arbitrary order ID in the AJAX request and does not properly verify whether the requesting authenticated user is authorized to create a refund request for that order. As a result, an authenticated user with subscriber-level privileges or higher can submit crafted AJAX requests to create refund requests against orders they did not place.
The practical impact is limited to creating fraudulent refund requests and interfering with marketplace order handling. The issue does not, based on the provided data, indicate direct code execution or full site compromise; the primary measurable effect is unauthorized modification of order-related state (integrity impact).
How This Could Impact Your Website
Consider a marketplace with several roles: a site owner who manages the store, internal staff who process orders, and external contractors or contributors who may have subscriber-level accounts. An attacker with a low-privilege account could create refund requests for other users’ orders, causing confusion in order processing, disputes with sellers, and administrative overhead to resolve fraudulent refunds.
Fraudulent refund activity can also surface order metadata or trigger communications that expose customer contact details or purchasing patterns, increasing the risk of targeted phishing or social engineering against staff or customers. If you rely on contractors or allow broad subscriber-level access, the risk of misuse increases.
If you are unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and subscribers.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and order logs for unusual behavior or unexpected refund requests.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
