WordPress Plugin Vulnerabilities

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution < 2.0.25 - Missing Authorization

Description

The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions like 'marketking_delete_team_member', 'marketkingrejectuser', 'marketking_save_profile_settings', and many more in all versions up to, and including, 2.0.00. This makes it possible for unauthenticated attackers to delete users, update settings, approve users, and more.

Affects Plugins

Plugin icon
marketking-multivendor-marketplace-for-woocommerce
Fixed in 2.0.25

References

CVE
CVE-2024-12413
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb809c9-7167-4333-969f-0141c96342bd

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Lucio Sá
Verified
No
WPVDB ID
82323516-0b56-4920-a16a-f4e9f4857196

Timeline

Publicly Published
2024-12-24 (about 1 year ago)
Added
2024-12-24 (about 1 year ago)
Last Updated
2024-12-25 (about 1 year ago)

Other

Published
Title
Published
2026-04-07
Title
Event Tickets Manager for WooCommerce < 1.5.4 - Missing Authorization
Published
2026-07-10
Title
WP Easy Pay < 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action
Published
2025-10-08
Title
Open Close WooCommerce Store <= 4.9.8 - Missing Authorization
Published
2025-12-15
Title
FileBird – WordPress Media Library Folders & File Manager < 6.5.2 - Missing Authorization to Authenticated (Author+) Global Folders Tampering
Published
2025-02-21
Title
Page and Post Lister <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion