EUVD-2026-26790Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.1 via the '/dokan/v1/stores/{id}/reviews' REST API endpoint. This is due to the 'prepare_reviews_for_response' method including reviewer email addresses, usernames, and user IDs in the API response. This makes it possible for unauthenticated attackers to extract email addresses, usernames, and user IDs of all customers who left reviews on any vendor's store. The Pro version of the plugin must be installed and activated, with store reviews enabled, in order to exploit the vulnerability.
AnalysisAI
Unauthenticated remote attackers can extract sensitive user information including email addresses, usernames, and user IDs through the '/dokan/v1/stores/{id}/reviews' REST API endpoint in Dokan plugin versions up to 4.3.1. The vulnerability affects only installations with the Pro version activated and store reviews enabled, allowing information disclosure of all customers who left vendor reviews. No public exploit code has been identified, but the attack requires no authentication or user interaction and can be automated at scale.
Technical ContextAI
The Dokan plugin's REST API StoreController contains a 'prepare_reviews_for_response' method that serializes customer review data without filtering sensitive fields. The endpoint '/dokan/v1/stores/{id}/reviews' exposes reviewer PII (email, username, user ID) via the HTTP response body. This is a failure to implement proper output filtering at the API serialization layer (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability exists in the Pro version when store reviews feature is enabled, affecting the REST API controller's data preparation logic documented in the plugin's source code at StoreController.php lines 125, 835, and 854.
RemediationAI
Update the Dokan plugin to version 4.3.2 or later, which the vendor released as a patched version (confirmed by changeset 3481799 on plugins.trac.wordpress.org). The patch modifies the 'prepare_reviews_for_response' method in StoreController.php to filter email addresses, usernames, and user IDs from REST API responses. For sites unable to immediately upgrade, disable the store reviews feature in Dokan Pro settings to block access to the vulnerable endpoint, though this disables customer review functionality. Alternatively, use a Web Application Firewall rule to deny unauthenticated requests to '/dokan/v1/stores/*/reviews' endpoints (trade-off: review API access unavailable for all clients). Verify upgrade completion by checking the plugin version in WordPress admin and testing that /dokan/v1/stores/{id}/reviews responses no longer include reviewer emails or IDs. References: https://www.wordfence.com/threat-intel/vulnerabilities/id/02b0d7d7-8a10-48de-b1e1-7e1f1fda6ffe?source=cve and https://plugins.trac.wordpress.org/changeset/3481799/
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and in
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL state
Improper access control in the Dokan WooCommerce Multivendor Marketplace WordPress plugin before 5.0.14 enables authenti
Dokan's WooCommerce multivendor marketplace WordPress plugin (versions before 5.0.11) exposes a broken object-level auth
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allo
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any
An authentication bypass vulnerability exists in Dokan (Dokan, Inc.) dokan-lite plugin versions through 4.2.4 that allow
Privilege escalation in Dokan WordPress plugin versions 5.0.2 and earlier allows authenticated low-privileged customer a
Broken object-level authorization in the Dokan WordPress plugin (versions before 5.0.9) allows any authenticated vendor
Order ownership bypass in Dokan Multivendor for WordPress (versions before 5.0.9) allows any authenticated vendor to mod
The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. Rate
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today