EUVD-2026-54736
GHSA-9qg2-vxvm-6fvv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible REST endpoint requires only a valid vendor account (PR:L); no scope change occurs and availability is unaffected, with limited confidentiality and integrity impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.
AnalysisAI
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level authorization flaw in one of its order REST API endpoints, enabling any authenticated vendor to grant their own customers free download access to paid downloadable files belonging to other vendors without the file owner's consent. Publicly available exploit code exists for this issue, reported by WPScan. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated vendor account on the target Dokan-powered WooCommerce marketplace - the attacker must be a registered and approved vendor, not merely a customer or unauthenticated user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) accurately reflects the threat model: network-accessible, low-complexity exploitation requiring only a valid vendor account, with limited but concrete confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious vendor registered on a Dokan-powered WooCommerce marketplace sends a crafted REST API request to the order download endpoint, substituting the product ID of a competing vendor's paid digital product. Because the endpoint does not validate product ownership, the system grants the malicious vendor's customer a download token for the file. … |
| Remediation | Update the Dokan plugin to version 5.0.11 or later, which is the vendor-released patch per WPScan's advisory (https://wpscan.com/vulnerability/b38dc6a4-a590-402f-88e1-3624a22c7348/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and in
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL state
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenti
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allo
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any
An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allow
Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer a
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to mod
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. Rate
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan - Bes
Reflected cross-site scripting in the Dokan (dokan-lite) WordPress multivendor marketplace plugin, versions up to and in
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today