CVE-2026-93342: MarketKing < 2.1.72 Missing Authorization via marketking_duplicate_product AJAX
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingduplicateproduct AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification to copy any vendor's product listings, including private product metadata, and assign the duplicated copy to their own vendor account without the victim's knowledge or consent.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with subscriber-level access or higher can exploit it. The attacker must be able to invoke the affected AJAX action and provide the ID of a product belonging to another vendor.
What can an attacker do with a successful exploit?
They can duplicate any vendor's product and assign the copied product to their own vendor account. This can expose private product metadata contained in the copied listing and lets the attacker copy listings without the owner's knowledge or consent.
Are installations running version 2.1.72 affected?
No. The issue affects MarketKing versions before 2.1.72.
How can administrators look for possible exploitation?
Review product records for duplicates assigned to unexpected vendor accounts, particularly copies of products owned by other vendors. Check whether copied listings include private metadata from the original vendor's products.