EUVD-2026-40928
GHSA-9cv2-mw8g-x6gp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network REST endpoint (AV:N) reachable by any authenticated vendor (PR:L) with no user interaction; missing capability allowlist yields administrator access and full C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the update_capabilities() REST handler accepting arbitrary capability strings from the request body and passing them directly to WP_User::add_cap() with no allowlist validation, only verifying that the caller holds the dokandar capability. This makes it possible for authenticated attackers with a self-provisioned Vendor-level access and above, on sites with the Vendor Staff module enabled, to grant arbitrary WordPress capabilities, including administrator, to any vendor_staff account, leading to a full site takeover.
Articles & Coverage 1
AnalysisAI
Privilege escalation in the Dokan Pro WooCommerce multivendor plugin for WordPress (all versions through 5.0.4) allows an authenticated vendor-level attacker to grant themselves or a controlled vendor_staff account the WordPress administrator capability, resulting in full site takeover. The flaw stems from the update_capabilities() REST handler accepting arbitrary capability strings with no allowlist, only checking for the dokandar capability. No public exploit has been identified at time of analysis, and no EPSS or KEV signals were supplied; however, the issue is reported by Wordfence and exploitation is straightforward on sites where the Vendor Staff module is enabled and vendor self-registration is permitted.
Technical ContextAI
Dokan Pro is the commercial extension of the widely used Dokan multivendor marketplace plugin (vendor weDevs, CPE cpe:2.3:a:wedevs:dokan_pro), which turns a WooCommerce store into a multi-seller marketplace with per-vendor staff accounts. The vulnerability lives in the plugin's REST API layer: the update_capabilities() endpoint reads capability identifiers directly from the request body and passes them to WordPress core's WP_User::add_cap(), which unconditionally attaches any capability string to a user's meta. The only authorization gate is a check that the caller holds the dokandar (vendor) capability, and there is no allowlist restricting which capabilities may be assigned. This is a textbook CWE-269 (Improper Privilege Management) failure - the code trusts client-supplied privilege identifiers and provides no separation between capabilities a vendor may legitimately delegate to staff and high-privilege capabilities such as administrator.
RemediationAI
No vendor-released patched version was identified at time of analysis; the description confirms only that versions through 5.0.4 are vulnerable, so administrators should upgrade to the latest Dokan Pro release above 5.0.4 as soon as weDevs publishes a fix and monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff9c202-b3e8-4660-8763-a9fee468203e?source=cve) and https://dokan.co/ for the exact fixed version. Until a patch is applied, the most effective compensating control is to disable the Vendor Staff module, which removes the vulnerable endpoint entirely at the cost of losing staff-account functionality for vendors. Where the Staff module must stay enabled, temporarily disable open vendor self-registration (require manual admin approval of new vendors) to remove the low-privilege foothold, and restrict or WAF-filter access to the Dokan REST update_capabilities route; audit existing vendor_staff and vendor accounts for any that already hold administrator or other elevated capabilities and revoke them, since a successful attack leaves a persistent privileged account behind.
SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (all versions ≤ 5.0.4) lets unauthenticated remo
Broken access control in Dokan Pro (the premium extension of the Dokan multivendor marketplace plugin for WordPress) thr
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding
Authenticated SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (versions <= 5.0.2) allows a low-p
Stored/reflected Cross-Site Scripting in the Dokan Pro WordPress multivendor marketplace plugin (versions up to and incl
Time-based blind SQL injection in the Dokan Pro WordPress plugin allows network-accessible authenticated attackers with
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today