Dokan Pro CVE-2026-12224

Exploitation requires the Vendor Staff module to be enabled in Dokan Pro (the module that exposes the update_capabilities() REST endpoint) and the attacker to hold at least a self-provisioned Vendor-level account carrying the dokandar capability - commonly obtainable on marketplaces that allow open vendor registration. Given those, the attacker POSTs arbitrary capability strings (e.g. administrator) to the endpoint to elevate a vendor_staff account. Limiting factors: the Staff module is not enabled on every Dokan site, sites that gate vendor sign-up behind manual admin approval remove the easy foothold, and the attacker needs a valid authenticated session (PR:L) rather than pure anonymous access; no user interaction and no non-standard client are otherwise required.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8 High) accurately reflects a network-reachable, low-complexity, low-privilege-required attack with full confidentiality, integrity and availability impact - consistent with a path to administrator. The meaningful mitigating factors are that the attacker must first hold vendor-level access and the target site must have the Vendor Staff module enabled; neither is guaranteed by default, so this is not a blanket unauthenticated RCE. However, many Dokan marketplaces intentionally allow open vendor self-registration, which effectively collapses the PR:L barrier to 'anyone who can sign up.' No EPSS score, KEV listing, or public POC was supplied in the intelligence, so real-world exploitation pressure cannot be quantified - the absence of a POC lowers immediate mass-exploitation likelihood but does not reduce the technical severity. This is a genuine priority for any live Dokan marketplace with staff features and open registration, and a lower priority for invite-only vendor sites with the Staff module disabled.

An attacker registers (or already holds) a vendor account on a Dokan marketplace that has the Vendor Staff module enabled, creates a vendor_staff account, then sends a crafted authenticated request to the update_capabilities() REST endpoint supplying 'administrator' as a capability. Because the handler only checks for the dokandar capability and applies no allowlist, the staff account is granted administrator rights, giving the attacker full control of the WordPress site. No public POC was supplied, but the attack is network-based and low-complexity per the CVSS vector.