---
id: "CVE-2026-111847"
kind: "vulnerability"
aliases: ["CVE-2026-111847"]
title: "MarketKing WooCommerce plugin: missing authorization check exposes access control"
severity: "medium"
cvss: 5.4
epss: 0.00138
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["marketking", "package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-22T07:16:41+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:14:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111847", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111847", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# MarketKing WooCommerce plugin: missing authorization check exposes access control

MarketKing, a WordPress multivendor marketplace plugin for WooCommerce, lacks an authorization check on some functionality, so access controls are not enforced as intended. The sources do not say which actions an attacker can perform or what data they can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MarketKing version in the WordPress admin plugins list or with `wp plugin get marketking-multivendor-marketplace-for-woocommerce --field=version`
- Compare the result against the affected range, `2.1.72` and earlier

## Fix

- Update MarketKing to a version later than `2.1.72` once the vendor publishes one; the sources do not name a fixed version
- Until a fixed version is available, unknown

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111847
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111847

## From the sources

Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_