The vulnerability is caused by a missing authorization check in the MarketKing plugin’s marketking_duplicate_product AJAX action. Authenticated users with subscriber‑level access or higher can supply an arbitrary product ID to duplicate any vendor’s product, including private metadata. The duplicated product is then assigned to the attacker’s own vendor account without the victim’s awareness, allowing unauthorized copying of vendor listings and potential exposure of sensitive product data.

WebWizards MarketKing plugin for WordPress versions earlier than 2.1.72.

The flaw has a CVSS score of 5.3 and is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated WordPress session with at least subscriber permissions, limiting the attack to those with site access. While the EPSS score is unavailable, the presence of a missing authorization check means that any authenticated user can duplicate products. The risk level is moderate: attackers with legitimate accounts could stealthily copy vendor content, but the flaw cannot be used without existing site credentials.