CVE-2026-111847: Missing Authorization in Kings Plugins MarketKing

The vulnerability identified as CVE-2026-111847 in Kings Plugins MarketKing (a multivendor marketplace plugin for WooCommerce) is caused by missing authorization checks. This results from incorrectly configured access control security levels, which could allow users with limited privileges to perform actions they should not be authorized to execute. The affected versions range from the initial release up to version 2.1.72. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

Exploitation of this vulnerability could lead to unauthorized access or modification of data within the MarketKing plugin environment. The impact is limited to confidentiality and integrity, with no impact on availability. The vulnerability requires the attacker to have some privileges but no user interaction is needed for exploitation.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and tighten access control configurations in MarketKing to prevent unauthorized actions.