EUVD-2026-39948
GHSA-7w4v-h7g8-xr5r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any vendor account
-
DeliveryEnumerate product IDs via REST API 'id' parameter
-
ExploitGeneric capability check passes without ownership validation
-
ExecutionRetrieve draft and pending product records from competing vendors
-
ImpactHarvest unreleased product names, prices, and SKUs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires an authenticated WordPress account on the target site with at minimum subscriber-level access, and specifically requires that the attacker hold the 'dokandar' or 'dokan_view_product_menu' capability - both of which are granted automatically to all registered vendor accounts in Dokan by default. The site must be running the Dokan plugin with its REST API active (standard deployment configuration). The 'id' parameter on both the product collection endpoint and the single-item endpoint must be accessible, which is the default state. Exploitation is bounded by the following limiting factors: the attacker must have a valid authenticated vendor session on the specific marketplace instance (no unauthenticated access, no cross-site exploitation); impact is strictly read-only confidentiality disclosure of product metadata (no write, no code execution, no privilege elevation to administrator); and exposed data is scoped to product names, prices, SKUs, and descriptions belonging to other vendors on the same platform. |
| Impact | The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is well-calibrated for this vulnerability. The network attack vector and low attack complexity are accurate, as the REST API is accessible over HTTP with no special network position required. The PR:L requirement correctly reflects that a valid, authenticated vendor account is a prerequisite. The confidentiality impact is deliberately scored Low because the exposed data (product metadata) is business-sensitive but not system credentials, PII, or cryptographic material. There is no integrity or availability impact. EPSS data was not provided in this dataset, precluding a probability-of-exploitation comparison. The absence from CISA KEV and the lack of any reported POC mean the practical exploitation risk is currently theoretical; however, because every registered vendor account has the required capabilities by default, the exploit is trivially constructible by any motivated marketplace participant. The real-world business risk - particularly competitive intelligence exposure of unreleased or strategically priced products - may exceed what the numerical CVSS score implies for marketplace operators. No conflicting signals were identified; the CVSS vector is consistent with the described exploitation conditions. |
| Exploit ScenarioDerived | A registered vendor on a target Dokan-powered WooCommerce marketplace authenticates via their vendor account and sends HTTP GET requests to the Dokan REST API product endpoints, incrementing the 'id' parameter across a range of numeric values. Because the permission callback validates only the generic 'dokandar' capability present on all vendor accounts - not whether the product ID belongs to the requesting vendor - the API returns full product records for every valid ID, including draft listings of competing vendors that have not yet been published. No public POC has been identified, but the exploit requires only standard REST API tooling given the detailed code references already public in the Wordfence report. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 27, 2026
Insecure Direct Object Reference in Dokan WooCommerce Multivendor Marketplace plugin (all versions through 5.0.4) enables horizontal privilege escalation across vendor accounts via the REST API 'id' parameter. Authenticated attackers holding any vendor-level or subscriber-level account can retrieve full product records belonging to competing vendors, including unpublished draft and pending-review listings that expose product names, prices, SKUs, and descriptions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
RemediationAI
A code fix has been committed to the dokan-lite repository per WordPress plugin Trac changeset revision 3578095 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3578095%40dokan-lite&new=3578095%40dokan-lite); however, the exact patched release version number is not confirmed in available data - users should upgrade to the latest available Dokan version from the WordPress plugin repository and verify that the installed version post-dates this changeset. As a compensating control prior to patching, marketplace operators can restrict new vendor account registrations and enforce stricter review of existing vendor accounts to reduce the pool of users who could exploit the flaw. Additionally, WAF rules targeting REST API requests to Dokan product endpoints with iterating numeric 'id' values can detect enumeration attempts, though this does not close the underlying authorization gap. Disabling the Dokan REST API entirely would break marketplace functionality and is not a practical mitigation for most operators. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1359945a-cf4e-4883-830b-53a3fcd40e56 should be monitored for confirmed fix version details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Dokan's REST API layer, specifically in ProductController.php (lines 159, 473, 495) and its parent DokanRESTController.php (lines 39, 66, 299), as confirmed by direct code references in the WordPress plugin Trac repository at tag 5.0.4. CWE-639 (Authorization Through User-Controlled Key) is the root cause class: the permission callbacks for both the collection endpoint (listing multiple products) and the single-item endpoint verify only that the authenticated user holds the generic 'dokan_view_product_menu' or 'dokandar' capability - capabilities granted uniformly to all vendor accounts - without comparing the requested product's author ID or ownership record against the identity of the authenticated requester. This is a textbook horizontal IDOR in a REST API: access control is role-based at the capability level but not object-level, so any valid vendor can supply arbitrary numeric product IDs to retrieve records owned by peers on the same marketplace. The CPE string cpe:2.3:a:dokaninc:dokan covers all Dokan lite releases affected.
Know when Dokan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vendor account required (PR:L); network-accessible REST API (AV:N); confidentiality limited to peer product metadata with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution - Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read any other vendor's products - including unpublished draft and pending listings - exposing product names, prices, SKUs, and descriptions belonging to other vendors. The permission callbacks for both the collection endpoint and the single-item endpoint only verify the generic vendor capability ('dokan_view_product_menu' / 'dokandar'), which every vendor holds, rather than confirming the requested author ID or product ownership matches the authenticated user.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and in
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL state
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenti
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level auth
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allo
Unauthenticated privilege escalation in the Blocksy Companion WordPress plugin (versions up to and including 2.1.58) all
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any
Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer a
An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allow
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to mod
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. Rate
Exploit-DB