The flaw is a missing authorization check that lets users exploit incorrectly configured access control levels. An attacker can perform actions that should be restricted, such as modifying marketplace settings, accessing private vendor data, or granting themselves higher privileges. The vulnerability enables unauthorized data disclosure, modification, or privilege escalation within the WordPress site.

The issue affects Kings Plugins’ MarketKing – MarketKing Multivendor Marketplace for WooCommerce – versions up to and including 2.1.72. Any WordPress installation running one of these versions of the plugin is susceptible.

The CVSS score of 5.4 indicates a moderate risk. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through web requests to the plugin’s API endpoints; the attacker does not need authentication beyond an existing user session, so any visitor with access may exploit the missing checks.