Description
Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects MarketKing: from n/a through 2.1.60.
Published: 2026-09-04
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WordPress MarketKing plugin from Kings Plugins contains a Missing Authorization vulnerability that allows an attacker to bypass access controls and perform restricted actions on the site. This flaw is based on CWE‑862, Broken Access Control. The primary impact is unauthorized access to plugin functionality, which could lead to data manipulation or exposure.

Affected Systems

All WordPress sites using MarketKing version 2.1.60 or earlier, including any that have never upgraded beyond the initial release, are affected. The vulnerability applies to every installation of this plugin without a version upgrade.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, but the EPSS score is not available, providing no insight into current exploit probability. The flaw is not listed in the CISA KEV catalog. Attackers can likely exploit the issue via the web interface if they can reach the plugin’s endpoints, and no public exploit is documented.

Generated by OpenCVE AI on September 4, 2026 at 09:21 UTC.

Remediation

Vendor Solution

Update the WordPress MarketKing Plugin to the latest available version (at least 2.1.70).

OpenCVE Recommended Actions

  • Apply the vendor’s latest update to the MarketKing plugin (version 2.1.70 or later).
  • After updating, review the plugin’s access control configuration and ensure that only administrator roles can invoke protected functions.
  • If an update cannot be applied immediately, restrict the plugin’s operations to trusted user roles using a role editor or custom code, and monitor the site for unauthorized activity.

Generated by OpenCVE AI on September 4, 2026 at 09:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60.
Title WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-09-04T08:07:22.994Z

Reserved: 2026-09-03T16:41:28.561Z

Link: CVE-2026-85311

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T09:17:11.490

Modified: 2026-09-04T09:17:11.490

Link: CVE-2026-85311

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T09:30:04Z

Weaknesses