CVE-2026-93342

MarketKing < 2.1.72 Missing Authorization via marketking_duplicate_product AJAX

Medium5.3EPSS 0.32%

Published: 22 Sept 2026
Updated: 23 Sept 2026
Reserved: 17 Sept 2026
Assigned by: VulnCheck

Description

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification to copy any vendor's product listings, including private product metadata, and assign the duplicated copy to their own vendor account without the victim's knowledge or consent.

Timeline

2026
17 Sept 2026
17 Sept 2026
ID reserved
By VulnCheck
22 Sept 20265 days later
22 Sept 2026· 5 days later
Published
23 Sept 20261 day later
23 Sept 2026· 1 day later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-93342, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	Medium5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVDNVD · Deferred	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.32% · top 75% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

CWE-862: Missing Authorization (opens in a new tab)All about CWE-862 and its CVEs

Affected products

WebWizards · MarketKing
- affected < 2.1.72

References (3)

Changelog (opens in a new tab)release-notespatch
WordPress Download Page (opens in a new tab)product
https://www.vulncheck.com/advisories/marketking-missing-authorization-via-marketking-duplicate-product-ajax (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-93342](https://trackcve.app/badge/CVE-2026-93342.svg)](https://trackcve.app/cve/CVE-2026-93342)

Record last updated 23 Sept 2026, 15:49 UTC.