CVE-2024-12413 describes a missing authorization vulnerability in the MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress. Several functions including 'marketking_delete_team_member', 'marketkingrejectuser', and 'marketking_save_profile_settings' lack proper capability checks, enabling unauthenticated attackers to delete users, update profile settings, approve users, and perform other unauthorized actions. This vulnerability affects all versions up to and including 2.0.00. The CVSS 3.1 score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, and no user interaction needed, with impact limited to integrity.

An unauthenticated attacker can exploit this vulnerability to modify user data and marketplace settings without authorization. This can lead to unauthorized deletion of users, unauthorized approval of users, and unauthorized changes to profile settings. The vulnerability does not allow confidentiality or availability impacts but compromises data integrity within the affected plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WordPress installation and consider disabling or removing the MarketKing plugin if feasible. Monitor for vendor updates to apply an official patch or temporary fix once available.