CVE-2026-93341: Missing Authorization in WebWizards MarketKing
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers can submit crafted AJAX requests targeting any order ID to create fraudulent refund requests against orders they did not place, enabling marketplace disruption and unauthorized interference with other users' orders.
AI Analysis
Technical Summary
CVE-2026-93341 is a missing authorization vulnerability in the MarketKing WordPress plugin prior to version 2.1.72. The issue exists in the marketking_send_refund AJAX action, which does not properly verify that the requesting user is authorized to create a refund for the specified order. As a result, authenticated users with subscriber-level privileges or higher can submit crafted AJAX requests with arbitrary order IDs to generate fraudulent refund requests against orders they did not place.
Potential Impact
Attackers with subscriber-level or higher access can create unauthorized refund requests on any order, leading to potential marketplace disruption and unauthorized interference with other users' orders. This could result in financial loss or operational issues for marketplace operators and legitimate users.
Mitigation Recommendations
A fix is available in MarketKing version 2.1.72. Users should upgrade to version 2.1.72 or later to remediate this vulnerability. Until patched, restrict subscriber-level access or higher users from performing refund actions if possible.
CVE-2026-93341: Missing Authorization in WebWizards MarketKing
Description
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers can submit crafted AJAX requests targeting any order ID to create fraudulent refund requests against orders they did not place, enabling marketplace disruption and unauthorized interference with other users' orders.
CVSS v4.0
Score 5.3medium
Affected software
WebWizards
MarketKing
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-93341 is a missing authorization vulnerability in the MarketKing WordPress plugin prior to version 2.1.72. The issue exists in the marketking_send_refund AJAX action, which does not properly verify that the requesting user is authorized to create a refund for the specified order. As a result, authenticated users with subscriber-level privileges or higher can submit crafted AJAX requests with arbitrary order IDs to generate fraudulent refund requests against orders they did not place.
Potential Impact
Attackers with subscriber-level or higher access can create unauthorized refund requests on any order, leading to potential marketplace disruption and unauthorized interference with other users' orders. This could result in financial loss or operational issues for marketplace operators and legitimate users.
Mitigation Recommendations
A fix is available in MarketKing version 2.1.72. Users should upgrade to version 2.1.72 or later to remediate this vulnerability. Until patched, restrict subscriber-level access or higher users from performing refund actions if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-17T18:41:40.757Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab28aa7f7a7c5410641fa5a
Added to database: 09/22/2026, 14:03:19 UTC
Last enriched: 09/22/2026, 14:17:58 UTC
Last updated: 09/23/2026, 01:58:07 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.