Dokan CVE-2026-16575

No authentication is required - the CVSS PR:N vector confirms unauthenticated exploitation against any Dokan site running below version 5.0.14. The attacker must be able to reach the WordPress REST API over the network, which is standard for any public-facing WordPress site. Commission type is always disclosed; per-category commission rates are additionally exposed only when category-based commission is configured for the targeted vendor - this is a deployment-dependent amplifier, not a prerequisite. No special server configuration, non-default plugin settings, or user interaction is required to trigger the disclosure. Exploitation is limited to read-only information disclosure of commission data; it does not provide write access, authentication bypass, or code execution.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately characterizes a trivially exploitable, unauthenticated network attack with bounded confidentiality impact and no integrity or availability consequences. The public availability of a proof-of-concept further reduces the skill barrier for exploitation. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified from that signal. The vulnerability does not appear in CISA KEV, so mass or targeted active exploitation has not been confirmed at time of analysis. Real-world risk is moderate for marketplace operators who treat commission structures as confidential business logic - competitors or vendors could enumerate rates to gain negotiating leverage - but there is no risk of system compromise, broader data exfiltration, or service disruption. This is a genuine remediation priority for affected sites but does not warrant emergency response.

An unauthenticated attacker enumerates vendor store identifiers from publicly visible WooCommerce storefront pages, then sends a crafted HTTP GET request to the Dokan store REST endpoint for each vendor. The endpoint returns commission type and per-category commission rates in the JSON response body without any authentication or authorization check, exposing the marketplace operator's full commission structure across all vendors. A publicly available proof-of-concept simplifies scripting this enumeration at scale.