CVE-2026-93341

4.3 MEDIUM

Published 2026-09-22 · Updated 2026-09-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers can submit crafted AJAX requests targeting any order ID to create fraudulent refund requests against orders they did not place, enabling marketplace disruption and unauthorized interference with other users' orders.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-862

All references

https://marketkingplugin.com/changelog/
https://wordpress.org/plugins/marketking-multivendor-marketplace-for-woocommerce/
https://www.vulncheck.com/advisories/marketking-missing-authorization-via-marketking-send-refund-ajax

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-14484
MEDIUMCVE-2025-14486
MEDIUMCVE-2025-14487
UNSCOREDCVE-2026-100240
MEDIUMCVE-2026-100287
MEDIUMCVE-2026-100289
MEDIUMCVE-2026-100303PoC
MEDIUMCVE-2026-100305PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.