Dokan CVE-2026-16574

Exploitation requires an authenticated vendor account on the target Dokan-powered WooCommerce marketplace - the attacker must be a registered and approved vendor, not merely a customer or unauthenticated user. The target site must be running the Dokan multivendor plugin at a version below 5.0.11 with at least one other vendor offering paid downloadable products. The specific REST order endpoint that handles download permissions must be reachable over the network, which is standard in any default WooCommerce/Dokan deployment. Exploitation is limited to the download-grant context: the attacker cannot read, exfiltrate, or modify arbitrary files on the server - they can only cause the platform to issue unauthorized download access tokens to their own customers. Non-default firewall configurations blocking REST API access, or platforms with no downloadable products, would not be exploitable.

The NVD CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) accurately reflects the threat model: network-accessible, low-complexity exploitation requiring only a valid vendor account, with limited but concrete confidentiality and integrity impact. The EPSS score of 0.13% places this vulnerability in the bottom 3rd percentile for exploitation probability, a signal that mass automated exploitation is not currently underway, which is broadly consistent with the authenticated (PR:L) prerequisite that limits opportunistic scanning. However, the existence of publicly available exploit code (per WPScan) meaningfully lowers the bar for targeted abuse by malicious marketplace participants - a threat actor who is already a registered vendor on a platform has both the motive and access to exploit this directly. The business impact disproportionately exceeds the CVSS numeric score: marketplace operators suffer revenue loss, and victimized vendors lose control over their paid digital products. There is no CISA KEV listing, so confirmed active exploitation cannot be asserted. The SSVC framing suggests low urgency for external defenders but high urgency for marketplace platform administrators, as exploitation requires no external sophistication beyond vendor registration.

A malicious vendor registered on a Dokan-powered WooCommerce marketplace sends a crafted REST API request to the order download endpoint, substituting the product ID of a competing vendor's paid digital product. Because the endpoint does not validate product ownership, the system grants the malicious vendor's customer a download token for the file. Publicly available exploit code for this technique exists, lowering the skill threshold for abuse.