Dokan CVE-2026-107694

Exploitation requires an authenticated vendor account on the target Dokan marketplace (the vulnerable commission-calculation feature is only reachable by logged-in vendors), and the affected plugin version must be earlier than 5.2.0. The flaw is a missing ownership check: the attacker simply supplies another vendor's identifier in the commission-calculation request. The primary limiting factor is the authentication requirement - the attacker must obtain a vendor account, though many marketplaces allow self-service vendor registration, which lowers this barrier. No user interaction and no special non-default configuration are required beyond having the multivendor marketplace operational. Impact is limited strictly to disclosure of other vendors' commission rates and fixed fees - no data modification or service disruption.

This is a genuinely low-severity issue and the signals are consistent in pointing that way. The CVSS 3.1 base score of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) reflects an authenticated information-disclosure flaw with only a low confidentiality impact and no integrity or availability impact - an IDOR (CWE-200) where one vendor can read the commission rate and fixed fee the administrator set for other vendors. A public exploit exists (WPScan) and a vendor patch is available, but there is no EPSS score, no CISA KEV listing, and no SSVC data in the input, so there is no evidence of active exploitation. POC availability raises the practical likelihood of opportunistic abuse slightly, but POC existence is distinct from active exploitation and should not be conflated with it. One notable divergence: the supplied vector rates privileges as PR:H, yet the affected principal is a marketplace vendor account, which in most Dokan deployments is a low-privilege, often self-registerable role - this likely overstates the privilege barrier (see assessed vector). Net: a real but minor confidentiality leak of business-sensitive pricing data, appropriate for routine patching rather than emergency response.

An attacker registers or already holds a vendor account on a Dokan-powered marketplace, then invokes the commission-calculation functionality while substituting another vendor's identifier. Because the plugin does not verify that the requested vendor matches the requesting vendor, the attacker receives the commission rate and fixed fee the administrator privately configured for that competitor. A public exploit for this issue is available via WPScan, lowering the skill required.