CVE-2026-93342: Missing Authorization in WebWizards MarketKing
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification to copy any vendor's product listings, including private product metadata, and assign the duplicated copy to their own vendor account without the victim's knowledge or consent.
AI Analysis
Technical Summary
CVE-2026-93342 describes a missing authorization vulnerability in the MarketKing WordPress plugin prior to version 2.1.72. The flaw exists in the marketking_duplicate_product AJAX action, which does not properly verify ownership before allowing duplication of products. As a result, authenticated users with subscriber-level privileges or higher can supply arbitrary product IDs to duplicate any vendor's product listings, including private metadata, and assign the duplicated products to their own accounts.
Potential Impact
An attacker with subscriber-level access or higher can duplicate any vendor's product listings without authorization. This includes copying private product metadata and assigning the duplicated product to their own vendor account. This could lead to unauthorized product replication, potential intellectual property theft, and confusion or fraud in the marketplace. However, the vulnerability requires authentication and does not allow privilege escalation or remote code execution.
Mitigation Recommendations
A fix is available in MarketKing version 2.1.72. Users should upgrade to version 2.1.72 or later to remediate this vulnerability. Until patched, restrict subscriber-level access or higher to trusted users only. Monitor for unauthorized product duplications if patching is delayed.
CVE-2026-93342: Missing Authorization in WebWizards MarketKing
Description
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification to copy any vendor's product listings, including private product metadata, and assign the duplicated copy to their own vendor account without the victim's knowledge or consent.
CVSS v4.0
Score 5.3medium
Affected software
WebWizards
MarketKing
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-93342 describes a missing authorization vulnerability in the MarketKing WordPress plugin prior to version 2.1.72. The flaw exists in the marketking_duplicate_product AJAX action, which does not properly verify ownership before allowing duplication of products. As a result, authenticated users with subscriber-level privileges or higher can supply arbitrary product IDs to duplicate any vendor's product listings, including private metadata, and assign the duplicated products to their own accounts.
Potential Impact
An attacker with subscriber-level access or higher can duplicate any vendor's product listings without authorization. This includes copying private product metadata and assigning the duplicated product to their own vendor account. This could lead to unauthorized product replication, potential intellectual property theft, and confusion or fraud in the marketplace. However, the vulnerability requires authentication and does not allow privilege escalation or remote code execution.
Mitigation Recommendations
A fix is available in MarketKing version 2.1.72. Users should upgrade to version 2.1.72 or later to remediate this vulnerability. Until patched, restrict subscriber-level access or higher to trusted users only. Monitor for unauthorized product duplications if patching is delayed.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-17T18:41:40.757Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab28aa7f7a7c5410641fa5b
Added to database: 09/22/2026, 14:03:19 UTC
Last enriched: 09/22/2026, 14:17:54 UTC
Last updated: 09/23/2026, 01:58:07 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.