EUVD-2026-39948
GHSA-7w4v-h7g8-xr5r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vendor account required (PR:L); network-accessible REST API (AV:N); confidentiality limited to peer product metadata with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution - Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read any other vendor's products - including unpublished draft and pending listings - exposing product names, prices, SKUs, and descriptions belonging to other vendors. The permission callbacks for both the collection endpoint and the single-item endpoint only verify the generic vendor capability ('dokan_view_product_menu' / 'dokandar'), which every vendor holds, rather than confirming the requested author ID or product ownership matches the authenticated user.
AnalysisAI
Insecure Direct Object Reference in Dokan WooCommerce Multivendor Marketplace plugin (all versions through 5.0.4) enables horizontal privilege escalation across vendor accounts via the REST API 'id' parameter. Authenticated attackers holding any vendor-level or subscriber-level account can retrieve full product records belonging to competing vendors, including unpublished draft and pending-review listings that expose product names, prices, SKUs, and descriptions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in Dokan's REST API layer, specifically in ProductController.php (lines 159, 473, 495) and its parent DokanRESTController.php (lines 39, 66, 299), as confirmed by direct code references in the WordPress plugin Trac repository at tag 5.0.4. CWE-639 (Authorization Through User-Controlled Key) is the root cause class: the permission callbacks for both the collection endpoint (listing multiple products) and the single-item endpoint verify only that the authenticated user holds the generic 'dokan_view_product_menu' or 'dokandar' capability - capabilities granted uniformly to all vendor accounts - without comparing the requested product's author ID or ownership record against the identity of the authenticated requester. This is a textbook horizontal IDOR in a REST API: access control is role-based at the capability level but not object-level, so any valid vendor can supply arbitrary numeric product IDs to retrieve records owned by peers on the same marketplace. The CPE string cpe:2.3:a:dokaninc:dokan covers all Dokan lite releases affected.
RemediationAI
A code fix has been committed to the dokan-lite repository per WordPress plugin Trac changeset revision 3578095 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3578095%40dokan-lite&new=3578095%40dokan-lite); however, the exact patched release version number is not confirmed in available data - users should upgrade to the latest available Dokan version from the WordPress plugin repository and verify that the installed version post-dates this changeset. As a compensating control prior to patching, marketplace operators can restrict new vendor account registrations and enforce stricter review of existing vendor accounts to reduce the pool of users who could exploit the flaw. Additionally, WAF rules targeting REST API requests to Dokan product endpoints with iterating numeric 'id' values can detect enumeration attempts, though this does not close the underlying authorization gap. Disabling the Dokan REST API entirely would break marketplace functionality and is not a practical mitigation for most operators. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1359945a-cf4e-4883-830b-53a3fcd40e56 should be monitored for confirmed fix version details.
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and in
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL state
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenti
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level auth
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allo
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any
An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allow
Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer a
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to mod
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. Rate
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today