EUVD-2026-52185
GHSA-cjjh-8xvm-fchv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable REST endpoint (AV:N), trivial to exploit once authenticated (AC:L), vendor account required (PR:L), no confidentiality or availability impact - only product attribute integrity is affected.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor's products on the marketplace.
AnalysisAI
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor on a multivendor marketplace to overwrite product attributes and default attributes belonging to other vendors via the plugin's REST API write endpoints. Exploitation requires only a low-privilege vendor account - no admin access needed - making this accessible to any registered seller on the platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an active Dokan vendor account (authenticated, low-privilege - PR:L per CVSS) on the target marketplace instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects the bounded impact: network-reachable, low complexity, but gated behind a vendor account (PR:L), with only integrity impact and no data exfiltration or denial-of-service potential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or already holds a vendor account on a target Dokan-powered WooCommerce marketplace. Using the publicly available PoC from WPScan, the attacker sends a crafted REST API PATCH or PUT request to the product-attribute write endpoint, substituting a competitor's product ID in place of their own. … |
| Remediation | Upgrade the Dokan plugin to version 5.0.9 or later, which introduces ownership verification on the product-attribute REST write endpoints. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and in
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL state
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenti
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level auth
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allo
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any
An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allow
Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer a
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to mod
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. Rate
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan - Bes
Reflected cross-site scripting in the Dokan (dokan-lite) WordPress multivendor marketplace plugin, versions up to and in
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today