MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor user ID. Attackers can bypass authorization controls by submitting a target vendor ID in the request to access payout pages, financial reports, and vendor dashboard content belonging to any vendor in the marketplace.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Marketking Multivendor Marketplace For Woocommerce Plugin | — | Update marketking-multivendor-marketplace-for-woocommerce plugin to version 2.1.72, or a newer patched version | Oct 30, 2026 | Sep 22, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub