MarketKing, a WordPress marketplace plugin, contains a missing authorization flaw in the marketking_admin_vendors_ajax AJAX action. The flaw allows any authenticated user with subscriber-level or higher privileges to craft an AJAX request and retrieve the full vendor directory, including user IDs, usernames, and email addresses for all registered vendors, thereby exposing personally identifiable information. This constitutes an Access Control error (CWE-862).

The vulnerability affects the WebWizards MarketKing plugin for WordPress when running any version prior to 2.1.72. Any site that has not upgraded to 2.1.72 or later is potentially exposed, regardless of the underlying WordPress core version.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the required condition is only that the attacker is an authenticated user with subscriber or higher role, which many sites grant to regular users. Once authenticated, the attacker can send a crafted AJAX request to the vulnerable endpoint and retrieve all vendor information. Because no additional network restrictions are needed, the vulnerability can be readily exploited in typical WordPress installations that host the affected MarketKing plugin.