{"id":"CVE-2026-111847","kind":"vulnerability","aliases":["CVE-2026-111847"],"related":[],"title":"MarketKing WooCommerce plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72.","summary":"MarketKing, a WordPress multivendor marketplace plugin for WooCommerce, lacks an authorization check on some functionality, so access controls are not enforced as intended. The sources do not say which actions an attacker can perform or what data they can reach.","severity":"medium","cvss":5.4,"epss":0.00138,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["marketking","package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed MarketKing version in the WordPress admin plugins list or with `wp plugin get marketking-multivendor-marketplace-for-woocommerce --field=version`\n- Compare the result against the affected range, `2.1.72` and earlier","fix":"- Update MarketKing to a version later than `2.1.72` once the vendor publishes one; the sources do not name a fixed version\n- Until a fixed version is available, unknown","status":"open","published_at":"2026-10-22T07:16:41+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:14:25+00:00","updated_at":"2026-10-25T04:14:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:14:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update MarketKing to a version later than `2.1.72` once the vendor publishes one; the sources do not name a fixed version\n- Until a fixed version is available, unknown","reach":"internet","title":"MarketKing WooCommerce plugin: missing authorization check exposes access control","impact":"medium","summary":"MarketKing, a WordPress multivendor marketplace plugin for WooCommerce, lacks an authorization check on some functionality, so access controls are not enforced as intended. The sources do not say which actions an attacker can perform or what data they can reach.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","marketking","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access to marketplace functions without proper authorization checks","analyst_note":"Find the vendor advisory or the plugin changelog to confirm which endpoints lack the check, whether authentication is required, and the first fixed version.","how_to_check":"- Check the installed MarketKing version in the WordPress admin plugins list or with `wp plugin get marketking-multivendor-marketplace-for-woocommerce --field=version`\n- Compare the result against the affected range, `2.1.72` and earlier","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the MarketKing multivendor marketplace plugin for WooCommerce at version `2.1.72` or earlier are in scope. Sites that do not have this plugin installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000622,"input_tokens":3362,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111847':12A,15A '-2026':11A,14A '2.1.72':90C 'access':8A,39B,80C 'action':52B 'affect':85C 'allow':76C 'attack':54B 'author':5A,33B,64C 'check':6A,34B 'configur':79C 'control':9A,40B,81C 'cve':10A,13A 'data':59B 'enforc':43B 'exploit':77C 'expos':7A 'function':37B 'host':20B 'incorrect':78C 'intend':45B 'issu':84C 'king':67C 'lack':31B 'levels.this':83C 'marketk':1A,16B,23B,69C,71C,86C 'marketking-multivendor-marketplace-for-woocommerc':70C 'marketplac':27B,73C 'miss':4A,63C 'multivendor':26B,72C 'n/a':88C 'packag':17B 'perform':56B 'plugin':3A,28B,68C 'reach':62B 'say':50B 'secur':82C 'self':19B 'self-host':18B 'sourc':47B 'vulner':65C 'woocommerc':2A,21B,30B,75C 'wordpress':22B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MarketKing multivendor marketplace plugin for WooCommerce at version `2.1.72` or earlier are in scope. Sites that do not have this plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T07:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111847","severity":null,"published_at":"2026-10-22T07:16:41+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111847","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111847","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}