A missing authorization vulnerability in the WebWizards MarketKing plugin allows authenticated attackers to perform unauthorized data extraction of vendor information, posing a significant privacy risk.

This is a CWE-862 Missing Authorization flaw located in the marketking_admin_vendors_ajax AJAX action. It allows any authenticated user, including those with minimal subscriber-level permissions, to trigger an AJAX request that bypasses capability checks to return the full vendor directory.

The exploitation of this vulnerability results in the unauthorized disclosure of personally identifiable information, including internal user IDs, usernames, and email addresses of all registered vendors. With a CVSS score of 6.5, this medium-severity flaw represents a significant risk to data privacy and compliance, as it grants attackers broad visibility into the platform's user base that should be restricted to administrative roles.

Immediate Action: Update the WebWizards MarketKing plugin to version 2.1.72 or later to apply the necessary capability checks.

Proactive Monitoring: Review web server and application logs for unusual spikes in AJAX requests directed at the marketking_admin_vendors_ajax endpoint, particularly those originating from low-privileged subscriber accounts.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to block unauthorized access to the specific AJAX endpoint until the update can be applied.

Public Exploit Available: Unknown

Given that this vulnerability exposes sensitive vendor data to any logged-in user, it should be treated with urgency to prevent potential data harvesting campaigns. Administrators must prioritize updating to version 2.1.72 immediately to ensure that proper authorization checks are enforced for all vendor management actions.