CVE-2026-93343 describes a missing authorization vulnerability in the MarketKing WordPress plugin prior to version 2.1.72. Specifically, the marketking_admin_vendors_ajax AJAX action does not enforce capability checks, enabling authenticated users with minimal privileges (subscriber-level or higher) to send crafted AJAX requests that retrieve the complete vendor directory. This results in exposure of internal user IDs, usernames, and email addresses of all registered vendors, violating access control and confidentiality principles.

The vulnerability allows any logged-in user, regardless of role, to access sensitive personally identifiable information (PII) of all vendors registered in the MarketKing plugin. This unauthorized data disclosure can lead to privacy violations and potential targeted attacks against vendors. There is no indication of privilege escalation or remote code execution, but the confidentiality breach is significant.

A fix is available in MarketKing version 2.1.72 that addresses this missing authorization vulnerability. Users should upgrade to version 2.1.72 or later to remediate this issue. Since the vendor advisory or patch links are not provided, verify the availability of the update from the official WebWizards source before applying.