What is the CVSS score of CVE-2026-3504?

CVE-2026-3504 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Dokan WordPress Plugin CVE-2026-3504

EUVD-2026-26790 MEDIUM

Information Exposure (CWE-200)

2026-05-02 Wordfence

WordPress Information Disclosure Dokan Wordpress Plugin Dokaninc

5.3

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker discovers WordPress site running Dokan
Delivery

Sends GET request to /wp-json/dokan/v1/stores/{id}/reviews
Exploit

REST API returns JSON containing reviewer emails and usernames
Execution

Attacker iterates store IDs to enumerate all customers
Persist

Extracts and correlates email addresses to vendors
Impact

Uses dataset for phishing or competitive intelligence

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	CRITICAL prerequisites limit real-world scope: (1) The Pro version of Dokan must be installed and activated - the free Lite version does not include this vulnerability. (2) The 'store reviews' feature must be explicitly enabled in Dokan Pro settings. (3) At least one customer review must exist on a vendor's store page. If any of these conditions are unmet, the endpoint either does not exist or returns no sensitive data. No authentication, no user interaction, and no special HTTP headers are required - default WordPress REST API settings suffice. Network access to the WordPress installation is the sole technical requirement. The vulnerability is NOT present in default Dokan Lite; it is Pro-exclusive.
Impact	CVSS 5.3 with AV:N/AC:L/PR:N/UI:N indicates network-accessible information disclosure of low confidentiality impact. However, real-world risk is conditional on three activation requirements: Pro version must be installed, store reviews must be enabled, and at least one review must exist. The lack of EPSS score, KEV listing, or confirmed public exploits suggests this is not currently a priority target despite accessible vector. The attack is trivially automatable (no user interaction, low complexity) but targets only sites meeting all three prerequisites. For affected deployments, risk is HIGH (complete enumeration of customer identities); for the broader WordPress install base, risk is MEDIUM-LOW due to feature gate and Pro-only licensing. Attackers can correlate extracted email addresses with vendor relationships and customer purchase history, creating privacy and targeting risks beyond simple enumeration.
Exploit ScenarioDerived	An attacker scripts HTTP GET requests to 'https://target.example/wp-json/dokan/v1/stores/1/reviews', iterating store IDs (1, 2, 3...) to harvest email addresses and usernames of all customers who reviewed vendor products. Each response contains full customer identifiers without authentication. The attacker builds a database of customer email addresses linked to specific vendors for phishing, social engineering, or competitive intelligence. The attack is completable in minutes against any Dokan Pro site with reviews enabled.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 02, 2026

Unauthenticated remote attackers can extract sensitive user information including email addresses, usernames, and user IDs through the '/dokan/v1/stores/{id}/reviews' REST API endpoint in Dokan plugin versions up to 4.3.1. The vulnerability affects only installations with the Pro version activated and store reviews enabled, allowing information disclosure of all customers who left vendor reviews. No public exploit code has been identified, but the attack requires no authentication or user interaction and can be automated at scale.

RemediationAI

Update the Dokan plugin to version 4.3.2 or later, which the vendor released as a patched version (confirmed by changeset 3481799 on plugins.trac.wordpress.org). The patch modifies the 'prepare_reviews_for_response' method in StoreController.php to filter email addresses, usernames, and user IDs from REST API responses. For sites unable to immediately upgrade, disable the store reviews feature in Dokan Pro settings to block access to the vulnerable endpoint, though this disables customer review functionality. Alternatively, use a Web Application Firewall rule to deny unauthenticated requests to '/dokan/v1/stores/*/reviews' endpoints (trade-off: review API access unavailable for all clients). Verify upgrade completion by checking the plugin version in WordPress admin and testing that /dokan/v1/stores/{id}/reviews responses no longer include reviewer emails or IDs. References: https://www.wordfence.com/threat-intel/vulnerabilities/id/02b0d7d7-8a10-48de-b1e1-7e1f1fda6ffe?source=cve and https://plugins.trac.wordpress.org/changeset/3481799/

Affected VersionsENISA

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy 0 ≤4.3.1

Affected Packages

euvd dokan_ai_powered_woocommerce_multivendor_marketplace_solution_build_your_own_amazon_ebay_etsy no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The Dokan plugin's REST API StoreController contains a 'prepare_reviews_for_response' method that serializes customer review data without filtering sensitive fields. The endpoint '/dokan/v1/stores/{id}/reviews' exposes reviewer PII (email, username, user ID) via the HTTP response body. This is a failure to implement proper output filtering at the API serialization layer (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability exists in the Pro version when store reviews feature is enabled, affecting the REST API controller's data preparation logic documented in the plugin's source code at StoreController.php lines 125, 835, and 854.

Know when Dokan gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

DescriptionCVE.org

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.1 via the '/dokan/v1/stores/{id}/reviews' REST API endpoint. This is due to the 'prepare_reviews_for_response' method including reviewer email addresses, usernames, and user IDs in the API response. This makes it possible for unauthenticated attackers to extract email addresses, usernames, and user IDs of all customers who left reviews on any vendor's store. The Pro version of the plugin must be installed and activated, with store reviews enabled, in order to exploit the vulnerability.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.