A missing authorization vulnerability in the WebWizards MarketKing plugin allows authenticated users to access sensitive vendor administrator pages, potentially exposing financial and private marketplace data.

This flaw involves a missing capability check within the marketking_get_page_content AJAX action, which permits any authenticated user with at least subscriber-level access to impersonate vendor administrative requests by specifying an arbitrary vendor user ID.

The exploitation of this vulnerability could lead to significant unauthorized access to sensitive business information, including financial reports, payout details, and internal vendor dashboard data. Given the CVSS score of 6.5, this medium-severity issue poses a substantial risk to marketplace confidentiality, potentially resulting in competitive damage or the exposure of private vendor records to unauthorized parties.

Immediate Action: Update the WebWizards MarketKing plugin to version 2.1.72 or later to apply the necessary authorization controls.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the marketking_get_page_content AJAX endpoint, particularly those originating from low-privileged subscriber accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict access to AJAX actions that handle sensitive vendor-specific data if immediate patching is not feasible.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing the MarketKing plugin for WooCommerce should prioritize this update to prevent unauthorized data exposure. Please verify that all marketplace administrators and vendors are protected by updating the plugin to version 2.1.72 immediately, as this is the only definitive way to resolve the underlying authorization flaw.