Dokan Marketplace CVE-2026-16565

Exploitation requires the attacker to hold an active Dokan vendor account (authenticated, low-privilege - PR:L per CVSS) on the target marketplace instance. The vulnerable code path is specifically the product-attribute and default-attribute REST write endpoints exposed by the Dokan plugin; the plugin must be installed and active on a WooCommerce site running a version prior to 5.0.9. No special server-side configuration beyond a standard Dokan installation is needed. Exploitation is limited by the vendor account prerequisite - unauthenticated or subscriber-level users cannot exploit this flaw. Marketplaces with open or free vendor registration are at elevated risk since the barrier to obtaining the required privilege level is minimal.

The NVD CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects the bounded impact: network-reachable, low complexity, but gated behind a vendor account (PR:L), with only integrity impact and no data exfiltration or denial-of-service potential. The EPSS score of 0.13% at the 3rd percentile suggests very low observed exploitation pressure despite the availability of a public PoC, likely because the attack surface requires an active vendor registration on each targeted marketplace instance. No CISA KEV listing confirms no mass exploitation detected at time of analysis. The realistic risk is highest for marketplaces with open or low-barrier vendor registration, where a malicious actor could self-register and immediately abuse the endpoint to tamper with competitor product listings - a meaningful business integrity risk even if technical severity is moderate. No signal conflicts between CVSS, EPSS, and KEV status are present.

An attacker registers or already holds a vendor account on a target Dokan-powered WooCommerce marketplace. Using the publicly available PoC from WPScan, the attacker sends a crafted REST API PATCH or PUT request to the product-attribute write endpoint, substituting a competitor's product ID in place of their own. The server applies the attribute changes without verifying ownership, allowing the attacker to corrupt or manipulate a competitor's product variants, potentially degrading listing quality or causing incorrect product options to appear to buyers.