CVE-2026-93341

Name of the Vulnerable Software and Affected Versions MarketKing plugin for WordPress versions prior to 2.1.72

Description An authorization flaw exists in the marketking send refund AJAX action. Authenticated users with subscriber-level access or higher can create fraudulent refund requests for any order by providing an arbitrary order ID. This is achieved by submitting crafted AJAX requests, allowing unauthorized interference with orders not placed by the attacker and causing marketplace disruption.

Recommendations Update the MarketKing plugin for WordPress to version 2.1.72 or later.