Dokan Marketplace Plugin CVE-2026-16576

Exploitation requires an authenticated WordPress session with Shop Manager role or any role holding the WooCommerce management capability (manage_woocommerce). This is a common role assignment in multivendor marketplace deployments where third-party vendors are granted shop management access. The Dokan plugin must be installed and active in a version prior to 5.0.14, and WooCommerce must be present. Exploitation is limited by the requirement for a valid authenticated session - unauthenticated attackers cannot trigger the flaw. Sites that grant Shop Manager access exclusively to fully trusted internal staff face substantially lower realistic risk than those granting it to external vendors or customers.

The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately reflects the network-exploitable, high-privilege-required nature of this flaw. PR:H designates that authenticated Shop Manager access is the prerequisite, which limits opportunistic mass exploitation - however, in multivendor WooCommerce deployments, Shop Manager accounts are routinely granted to third-party vendors, dramatically broadening the realistic attacker population beyond typical high-privilege scenarios. The practical impact is effectively full site compromise: arbitrary plugin installation from WordPress.org is a recognized route to remote code execution on the underlying server. A publicly available proof-of-concept (reported by WPScan) further elevates urgency, as it lowers the skill bar for exploitation. No EPSS score was provided in the source data, and this CVE is not listed in the CISA KEV catalog, suggesting exploitation has not yet been observed at scale - but the POC's availability means this gap may close quickly. The SSVC automatable dimension is moderate: exploitation requires an authenticated session, but once obtained, the REST API path requires no further user interaction. Overall, this is a high-priority remediation item for any site granting Shop Manager access to external or semi-trusted parties.

An attacker with a Shop Manager account on a Dokan-powered WooCommerce site sends a crafted REST API request to a Dokan admin plugin-install endpoint, which passes the capability check because the site's Shop Manager role holds WooCommerce management capability. The attacker installs a backdoored or malicious plugin from WordPress.org, achieving remote code execution under the web server process. A publicly available proof-of-concept lowers the skill barrier for this attack.